Merge Official Source

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2022-03-26 22:44:00 +08:00 · 2022-03-26 22:44:00 +08:00 · 1e2bc6f636
commit 1e2bc6f636
parent a3dc82e4d1 c7bcbcd492
110 changed files with 7555 additions and 2496 deletions
--- a/include/kernel-defaults.mk
+++ b/include/kernel-defaults.mk
@ -174,13 +174,14 @@ ifeq ($(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE),y)
 ifneq ($(qstrip $(CONFIG_EXTERNAL_CPIO)),)
 	$(CP) $(CONFIG_EXTERNAL_CPIO) $(KERNEL_BUILD_DIR)/initrd.cpio
 else
-	( cd $(TARGET_DIR); find . | $(STAGING_DIR_HOST)/bin/cpio -o -H newc -R 0:0 > $(KERNEL_BUILD_DIR)/initrd.cpio )
+	( cd $(TARGET_DIR); find . | LC_ALL=C sort | $(STAGING_DIR_HOST)/bin/cpio --reproducible -o -H newc -R 0:0 > $(KERNEL_BUILD_DIR)/initrd.cpio )
 endif
+	$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(KERNEL_BUILD_DIR)/initrd.cpio)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_BZIP2),bzip2 -9 -c < $(KERNEL_BUILD_DIR)/initrd.cpio > $(KERNEL_BUILD_DIR)/initrd.cpio.bzip2)
-	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),gzip -f -S .gzip -9n $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_GZIP),gzip -n -f -S .gzip -9n $(KERNEL_BUILD_DIR)/initrd.cpio)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA),$(STAGING_DIR_HOST)/bin/lzma e -lc1 -lp2 -pb2 $(KERNEL_BUILD_DIR)/initrd.cpio $(KERNEL_BUILD_DIR)/initrd.cpio.lzma)
 # ?	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZO),)
-	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),$(STAGING_DIR_HOST)/bin/xz -9 -fz --check=crc32 $(KERNEL_BUILD_DIR)/initrd.cpio)
+	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_XZ),$(STAGING_DIR_HOST)/bin/xz -T0 -9 -fz --check=crc32 $(KERNEL_BUILD_DIR)/initrd.cpio)
 # ?	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_LZ4),)
 	$(if $(CONFIG_TARGET_INITRAMFS_COMPRESSION_ZSTD),$(STAGING_DIR_HOST)/bin/zstd -T0 -f -o $(KERNEL_BUILD_DIR)/initrd.cpio.zstd $(KERNEL_BUILD_DIR)/initrd.cpio)
 endif
--- a/package/libs/openssl/engine.mk
+++ b/package/libs/openssl/engine.mk
@ -1,3 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2022 Enéas Ulir de Queiroz
+
 ENGINES_DIR=engines-1.1

 define Package/openssl/engine/Default
--- a/package/base-files/files/lib/upgrade/common.sh
+++ b/package/base-files/files/lib/upgrade/common.sh
@ -155,9 +155,11 @@ export_bootdevice() {
 				fi
 			done
 		;;
+		PARTUUID=????????-????-????-????-??????????0?/PARTNROFF=1 | \
 		PARTUUID=????????-????-????-????-??????????02)
 			uuid="${rootpart#PARTUUID=}"
-			uuid="${uuid%02}00"
+			uuid="${uuid%/PARTNROFF=1}"
+			uuid="${uuid%0?}00"
 			for disk in $(find /dev -type b); do
 				set -- $(dd if=$disk bs=1 skip=568 count=16 2>/dev/null | hexdump -v -e '8/1 "%02x "" "2/1 "%02x""-"6/1 "%02x"')
 				if [ "$4$3$2$1-$6$5-$8$7-$9" = "$uuid" ]; then
--- a/package/boot/uboot-envtools/files/oxnas
+++ b/package/boot/uboot-envtools/files/oxnas
@ -14,7 +14,7 @@ board=$(board_name)
 case "$board" in
 "cloudengines,pogoplug"*|\
 "shuttle,kd20")
-	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x2000" "0x2000" "1"
+	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x2000" "0x20000" "1"
 	;;
 "mitrastar,stg-212")
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x20000" "0x20000" "1"
--- a/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch
+++ b/package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch
@ -0,0 +1,60 @@
+From patchwork Mon Mar 21 23:22:23 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 1607954
+Return-Path: <u-boot-bounces@lists.denx.de>
+X-Original-To: incoming@patchwork.ozlabs.org
+Delivered-To: patchwork-incoming@bilbo.ozlabs.org
+Date: Mon, 21 Mar 2022 23:22:23 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: u-boot@lists.denx.de
+Cc: Simon Glass <sjg@chromium.org>, Alexandru Gagniuc <mr.nuke.me@gmail.com>,
+ Patrick Delaunay <patrick.delaunay@foss.st.com>,
+ Heinrich Schuchardt <xypron.glpk@gmx.de>
+Subject: [PATCH] image-fdt: save name of FIT configuration in '/chosen' node
+Message-ID: <YjkIr8wmz1XEOVNh@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-BeenThere: u-boot@lists.denx.de
+X-Mailman-Version: 2.1.39
+Precedence: list
+List-Id: U-Boot discussion <u-boot.lists.denx.de>
+List-Unsubscribe: <https://lists.denx.de/options/u-boot>,
+ <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>
+List-Archive: <https://lists.denx.de/pipermail/u-boot/>
+List-Post: <mailto:u-boot@lists.denx.de>
+List-Help: <mailto:u-boot-request@lists.denx.de?subject=help>
+List-Subscribe: <https://lists.denx.de/listinfo/u-boot>,
+ <mailto:u-boot-request@lists.denx.de?subject=subscribe>
+Errors-To: u-boot-bounces@lists.denx.de
+Sender: "U-Boot" <u-boot-bounces@lists.denx.de>
+
+It can be useful for the OS (Linux) to know which configuration has
+been chosen by U-Boot when launching a FIT image.
+Store the name of the FIT configuration node used in a new string
+attribute called 'bootconf' in the '/chosen' node in device tree.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ boot/image-fdt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/boot/image-fdt.c b/boot/image-fdt.c
+index 692a9ad3e4..4017bc94a6 100644
+--- a/boot/image-fdt.c
+++ b/boot/image-fdt.c
+@@ -601,6 +601,12 @@ int image_setup_libfdt(bootm_headers_t *images, void *blob,
+ 		goto err;
+ 	}
+ 
+	/* Store name of configuration node as bootconf in /chosen node */
+	if (images->fit_uname_cfg)
+		fdt_find_and_setprop(blob, "/chosen", "bootconf",
+					images->fit_uname_cfg,
+					strlen(images->fit_uname_cfg) + 1, 1);
+
+ 	/* Update ethernet nodes */
+ 	fdt_fixup_ethernet(blob);
+ #if CONFIG_IS_ENABLED(CMD_PSTORE)
--- a/package/boot/uboot-mvebu/patches/013-mmc-xenon_sdhci-remove-wait_dat0-SDHCI-OP.patch
+++ b/package/boot/uboot-mvebu/patches/013-mmc-xenon_sdhci-remove-wait_dat0-SDHCI-OP.patch
@ -0,0 +1,64 @@
+From 0f3466f52fbacce67e147b9234e6323edff26a6d Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 11 Mar 2022 19:14:07 +0100
+Subject: [PATCH] mmc: xenon_sdhci: remove wait_dat0 SDHCI OP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Generic SDHCI driver received support for checking the busy status by
+polling the DAT[0] level instead of waiting for the worst MMC switch time.
+
+Unfortunately, it appears that this does not work for Xenon controllers
+despite being a part of the standard SDHCI registers and the Armada 3720
+datasheet itself telling that BIT(20) is useful for detecting the DAT[0]
+busy signal.
+
+I have tried increasing the timeout value, but I have newer managed to
+catch DAT_LEVEL bits change from 0 at all.
+
+This issue appears to hit most if not all SoC-s supported by Xenon driver,
+at least A3720, A8040 and CN9130 have non working eMMC currently.
+
+So, until a better solution is found drop the wait_dat0 OP for Xenon.
+I was able to only test it on A3720, but it should work for others as well.
+
+Fixes: 40e6f52454fc ("drivers: mmc: Add wait_dat0 support for sdhci driver")
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Marek Behún <marek.behun@nic.cz>
+Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
+Reviewed-by: Stefan Roese <sr@denx.de>
+---
+ drivers/mmc/xenon_sdhci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/xenon_sdhci.c
+++ b/drivers/mmc/xenon_sdhci.c
+@@ -439,6 +439,8 @@ static const struct sdhci_ops xenon_sdhc
+ 	.set_ios_post = xenon_sdhci_set_ios_post
+ };
+ 
+static struct dm_mmc_ops xenon_mmc_ops;
+
+ static int xenon_sdhci_probe(struct udevice *dev)
+ {
+ 	struct xenon_sdhci_plat *plat = dev_get_plat(dev);
+@@ -452,6 +454,9 @@ static int xenon_sdhci_probe(struct udev
+ 	host->mmc->dev = dev;
+ 	upriv->mmc = host->mmc;
+ 
+	xenon_mmc_ops = sdhci_ops;
+	xenon_mmc_ops.wait_dat0 = NULL;
+
+ 	/* Set quirks */
+ 	host->quirks = SDHCI_QUIRK_WAIT_SEND_CMD | SDHCI_QUIRK_32BIT_DMA_ADDR;
+ 
+@@ -568,7 +573,7 @@ U_BOOT_DRIVER(xenon_sdhci_drv) = {
+ 	.id		= UCLASS_MMC,
+ 	.of_match	= xenon_sdhci_ids,
+ 	.of_to_plat = xenon_sdhci_of_to_plat,
+-	.ops		= &sdhci_ops,
+	.ops		= &xenon_mmc_ops,
+ 	.bind		= xenon_sdhci_bind,
+ 	.probe		= xenon_sdhci_probe,
+ 	.remove		= xenon_sdhci_remove,
--- a/package/firmware/cypress-firmware/Makefile
+++ b/package/firmware/cypress-firmware/Makefile
@ -208,42 +208,6 @@ endef

 $(eval $(call BuildPackage,cypress-firmware-43570-pcie))

-# Cypress 4359 PCIe Firmware
-define Package/cypress-firmware-4359-pcie
-  $(Package/cypress-firmware-default)
-  TITLE:=CYW4359 FullMac PCIe firmware
-endef
-
-define Package/cypress-firmware-4359-pcie/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac4359-pcie.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4359-pcie.bin
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac4359-pcie.clm_blob \
-		$(1)/lib/firmware/brcm/brcmfmac4359-pcie.clm_blob
-endef
-
-$(eval $(call BuildPackage,cypress-firmware-4359-pcie))
-
-# Cypress 4359 SDIO Firmware
-define Package/cypress-firmware-4359-sdio
-  $(Package/cypress-firmware-default)
-  TITLE:=CYW4359 FullMac SDIO firmware
-endef
-
-define Package/cypress-firmware-4359-sdio/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac4359-sdio.bin \
-		$(1)/lib/firmware/brcm/brcmfmac4359-sdio.bin
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac4359-sdio.clm_blob \
-		$(1)/lib/firmware/brcm/brcmfmac4359-sdio.clm_blob
-endef
-
-$(eval $(call BuildPackage,cypress-firmware-4359-sdio))
-
 # Cypress 4373 SDIO Firmware
 define Package/cypress-firmware-4373-sdio
  $(Package/cypress-firmware-default)
@ -297,21 +261,3 @@ define Package/cypress-firmware-54591-pcie/install
 endef

 $(eval $(call BuildPackage,cypress-firmware-54591-pcie))
-
-# Cypress 89459 PCIe Firmware
-define Package/cypress-firmware-89459-pcie
-  $(Package/cypress-firmware-default)
-  TITLE:=CYW89459 FullMac PCIe firmware
-endef
-
-define Package/cypress-firmware-89459-pcie/install
-	$(INSTALL_DIR) $(1)/lib/firmware/brcm
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac89459-pcie.bin \
-		$(1)/lib/firmware/brcm/brcmfmac89459-pcie.bin
-	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/firmware/cyfmac89459-pcie.clm_blob \
-		$(1)/lib/firmware/brcm/brcmfmac89459-pcie.clm_blob
-endef
-
-$(eval $(call BuildPackage,cypress-firmware-89459-pcie))
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@ -42,6 +42,7 @@ ALLWIFIBOARDS:= \
 	glinet_gl-ap1300 \
 	glinet_gl-b2200 \
 	glinet_gl-s1300 \
+	google_wifi \
 	linksys_ea8300 \
 	linksys_mr8300-v0 \
 	luma_wrtq-329acn \
@ -54,7 +55,8 @@ ALLWIFIBOARDS:= \
 	p2w_r619ac \
 	plasmacloud_pa1200 \
 	plasmacloud_pa2200 \
-	qxwlan_e2600ac \
+	qxwlan_e2600ac-c1 \
+	qxwlan_e2600ac-c2 \
 	teltonika_rutx \
 	zte_mf286d

@ -134,6 +136,7 @@ $(eval $(call generate-ipq-wifi-package,ezviz_cs-w3-wd1200g-eup,EZVIZ CS-W3-WD12
 $(eval $(call generate-ipq-wifi-package,glinet_gl-ap1300,GL.iNet GL-AP1300))
 $(eval $(call generate-ipq-wifi-package,glinet_gl-b2200,GL.iNet GL-B2200))
 $(eval $(call generate-ipq-wifi-package,glinet_gl-s1300,GL.iNet GL-S1300))
+$(eval $(call generate-ipq-wifi-package,google_wifi,Google WiFi))
 $(eval $(call generate-ipq-wifi-package,linksys_ea8300,Linksys EA8300))
 $(eval $(call generate-ipq-wifi-package,linksys_mr8300-v0,Linksys MR8300))
 $(eval $(call generate-ipq-wifi-package,luma_wrtq-329acn,Luma WRTQ-329ACN))
@ -146,7 +149,8 @@ $(eval $(call generate-ipq-wifi-package,nec_wg2600hp3,NEC Platforms WG2600HP3))
 $(eval $(call generate-ipq-wifi-package,p2w_r619ac,P&W R619AC))
 $(eval $(call generate-ipq-wifi-package,plasmacloud_pa1200,Plasma Cloud PA1200))
 $(eval $(call generate-ipq-wifi-package,plasmacloud_pa2200,Plasma Cloud PA2200))
-$(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac,Qxwlan E2600AC))
+$(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c1,Qxwlan E2600AC C1))
+$(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c2,Qxwlan E2600AC C2))
 $(eval $(call generate-ipq-wifi-package,teltonika_rutx,Teltonika RUTX))
 $(eval $(call generate-ipq-wifi-package,zte_mf286d,ZTE MF286D))

--- a/package/firmware/ipq-wifi/board-google_wifi.qca4019
+++ b/package/firmware/ipq-wifi/board-google_wifi.qca4019
--- a/package/firmware/ipq-wifi/board-qxwlan_e2600ac-c1.qca4019
+++ b/package/firmware/ipq-wifi/board-qxwlan_e2600ac-c1.qca4019
--- a/package/firmware/ipq-wifi/board-qxwlan_e2600ac-c2.qca4019
+++ b/package/firmware/ipq-wifi/board-qxwlan_e2600ac-c2.qca4019
--- a/package/kernel/lantiq/ltq-vdsl-mei/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl-mei/Makefile
@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=ltq-vdsl-vr9-mei
 PKG_VERSION:=1.5.17.6
-PKG_RELEASE:=4
+PKG_RELEASE:=6

 PKG_BASE_NAME:=drv_mei_cpe
 PKG_SOURCE:=$(PKG_BASE_NAME)-$(PKG_VERSION).tar.gz
@ -29,7 +29,7 @@ define KernelPackage/ltq-vdsl-vr9-mei
  TITLE:=mei driver for vdsl
  SECTION:=sys
  SUBMENU:=Network Devices
-  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-ifxos
+  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-ifxos +kmod-ltq-vectoring
  FILES:=$(PKG_BUILD_DIR)/src/drv_mei_cpe.ko
  AUTOLOAD:=$(call AutoLoad,50,drv_mei_cpe)
 endef
--- a/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch
+++ b/package/kernel/lantiq/ltq-vdsl-mei/patches/100-compat.patch
@ -376,17 +376,6 @@
 }
 
 IFX_int32_t MEI_PLL_ConfigInit(MEI_DEV_T *pMeiDev)
--- a/src/drv_mei_cpe_dsm.c
-+++ b/src/drv_mei_cpe_dsm.c
-@@ -144,7 +144,7 @@ IFX_void_t MEI_VRX_DSM_DataInit(MEI_DEV_
-    memset((IFX_uint8_t *)&pMeiDev->firmwareFeatures, 0x00, sizeof(IOCTL_MEI_firmwareFeatures_t));
-    pMeiDev->meiFwDlCount = 0;
- 
-   pMeiDev->meiERBbuf.pCallBackFunc = mei_dsm_cb_func_hook;
-+   pMeiDev->meiERBbuf.pCallBackFunc = NULL;
- 
-    PRN_DBG_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_NORMAL,
-             ("MEI_DRV: PP callback function addr = 0x%08X" MEI_DRV_CRLF,
 --- a/src/drv_mei_cpe_download_vrx.c
 +++ b/src/drv_mei_cpe_download_vrx.c
@@ -3281,12 +3281,14 @@ IFX_int32_t MEI_DEV_IoctlFirmwareDownloa
--- a/package/kernel/lantiq/ltq-vdsl-mei/patches/200-interrupt-lock.patch
+++ b/package/kernel/lantiq/ltq-vdsl-mei/patches/200-interrupt-lock.patch
@ -0,0 +1,45 @@
+--- a/src/drv_mei_cpe_common.c
+++ b/src/drv_mei_cpe_common.c
+@@ -104,6 +104,8 @@ IFX_uint32_t MEI_FsmStateSetMsgPreAction
+ MEI_DEVCFG_DATA_T MEI_DevCfgData;
+ #endif
+ 
+static DEFINE_SPINLOCK(MEI_InterruptLock);
+
+ /* ============================================================================
+    Proc-FS and debug variable definitions
+    ========================================================================= */
+@@ -2134,6 +2136,9 @@ IFX_int32_t MEI_ProcessIntPerIrq(MEIX_CN
+ #if (MEI_SUPPORT_DEBUG_STREAMS == 1)
+    IFX_int_t   extraDbgStreamLoop = 0;
+ #endif
+   unsigned long flags;
+
+   spin_lock_irqsave(&MEI_InterruptLock, flags);
+ 
+    /* get the actual chip device from the list and step through the VRX devices */
+    while(pNextXCntrl)
+@@ -2167,6 +2172,8 @@ IFX_int32_t MEI_ProcessIntPerIrq(MEIX_CN
+    }
+ #endif
+ 
+   spin_unlock_irqrestore(&MEI_InterruptLock, flags);
+
+    return meiIntCnt;
+ }
+ 
+@@ -2639,9 +2646,14 @@ IFX_int32_t MEI_MsgSendPreAction(
+ */
+ IFX_void_t MEI_DisableDeviceInt(MEI_DEV_T *pMeiDev)
+ {
+   unsigned long flags;
+   spin_lock_irqsave(&MEI_InterruptLock, flags);
+
+    MEI_MaskInterrupts( &pMeiDev->meiDrvCntrl,
+                        ME_ARC2ME_INTERRUPT_MASK_ALL);
+ 
+   spin_unlock_irqrestore(&MEI_InterruptLock, flags);
+
+    return;
+ }
+ 
--- a/package/kernel/lantiq/ltq-vectoring/Makefile
+++ b/package/kernel/lantiq/ltq-vectoring/Makefile
@ -0,0 +1,61 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ltq-vectoring
+PKG_RELEASE:=$(AUTORELEASE)
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://gitlab.com/prpl-foundation/intel/ppa_drv.git
+PKG_SOURCE_DATE:=2019-05-20
+PKG_SOURCE_VERSION:=4fa7ac30fcc8ec4eddae9debba5f4230981f469f
+PKG_MIRROR_HASH:=444eb823dd9ddd25453976bf7a3230955e4148b8bf92f35f165ecffee32c4555
+PKG_LICENSE:=GPL-2.0 BSD-2-Clause
+
+MAKE_PATH:=src/vectoring
+PKG_EXTMOD_SUBDIRS:=$(MAKE_PATH)
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/ltq-vectoring
+  SECTION:=sys
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=driver for sending vectoring error samples
+  DEPENDS:=@TARGET_lantiq_xrx200
+  FILES:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/ltq_vectoring.ko
+  AUTOLOAD:=$(call AutoLoad,49,ltq_vectoring)
+endef
+
+define Package/ltq-vectoring/description
+	This driver is responsible for sending error reports to the vectoring
+	control entity, which is required for downstream vectoring to work.
+
+	The error reports are generated by the DSL firmware, and passed to this
+	driver by the MEI driver.
+endef
+
+define KernelPackage/ltq-vectoring-test
+  SECTION:=sys
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Devices
+  TITLE:=driver for testing the vectoring driver
+  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-vectoring
+  FILES:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/ltq_vectoring_test.ko
+endef
+
+define Package/ltq-vectoring-test/description
+	This allows to send dummy data to the vectoring error block callback.
+	This is only needed for test and development purposes.
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+	+$(MAKE) $(PKG_JOBS) -C "$(LINUX_DIR)" \
+		$(KERNEL_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)/$(MAKE_PATH)" \
+		modules
+endef
+
+$(eval $(call KernelPackage,ltq-vectoring))
+$(eval $(call KernelPackage,ltq-vectoring-test))
--- a/package/kernel/lantiq/ltq-vectoring/patches/001-fix-compile.patch
+++ b/package/kernel/lantiq/ltq-vectoring/patches/001-fix-compile.patch
@ -0,0 +1,95 @@
+--- a/src/vectoring/Makefile
+++ b/src/vectoring/Makefile
+@@ -1,5 +1,5 @@
+-obj-$(CONFIG_PTM_VECTORING)	+= ifxmips_vectoring.o
+-obj-y += ifxmips_vectoring_stub.o
+-ifeq ($(CONFIG_DSL_MEI_CPE_DRV),)
+-obj-$(CONFIG_PTM_VECTORING)	+= ifxmips_vectoring_test.o
+-endif
+obj-m += ltq_vectoring.o
+ltq_vectoring-objs = ifxmips_vectoring.o ifxmips_vectoring_stub.o
+
+obj-m += ltq_vectoring_test.o
+ltq_vectoring_test-objs = ifxmips_vectoring_test.o
+--- a/src/vectoring/ifxmips_vectoring.c
+++ b/src/vectoring/ifxmips_vectoring.c
+@@ -30,9 +30,11 @@
+ /*
+  *  Common Head File
+  */
+#include <linux/version.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/etherdevice.h>
+#include <linux/proc_fs.h>
+ 
+ /*
+  *  Chip Specific Head File
+@@ -239,7 +241,7 @@ static int netdev_event_handler(struct n
+         && event != NETDEV_UNREGISTER )
+         return NOTIFY_DONE;
+ 
+-    netif = (struct net_device *)netdev;
+    netif = netdev_notifier_info_to_dev(netdev);
+     if ( strcmp(netif->name, "ptm0") != 0 )
+         return NOTIFY_DONE;
+ 
+@@ -356,6 +358,7 @@ static int proc_write_dbg(struct file *f
+     return count;
+ }
+ 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0)
+ static struct file_operations g_proc_file_vectoring_dbg_seq_fops = {
+     .owner      = THIS_MODULE,
+     .open       = proc_read_dbg_seq_open,
+@@ -364,6 +367,15 @@ static struct file_operations g_proc_fil
+     .llseek     = seq_lseek,
+     .release    = single_release,
+ };
+#else
+static struct proc_ops g_proc_file_vectoring_dbg_seq_fops = {
+    .proc_open    = proc_read_dbg_seq_open,
+    .proc_read    = seq_read,
+    .proc_write   = proc_write_dbg,
+    .proc_lseek   = seq_lseek,
+    .proc_release = single_release,
+};
+#endif
+ 
+ static int proc_read_dbg_seq_open(struct inode *inode, struct file *file)
+ {
+--- a/src/vectoring/ifxmips_vectoring_test.c
+++ b/src/vectoring/ifxmips_vectoring_test.c
+@@ -1,6 +1,8 @@
+#include <linux/version.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+ 
+ #include "ifxmips_vectoring_stub.h"
+ 
+@@ -82,6 +84,7 @@ static int proc_write_vectoring(struct f
+     return count;
+ }
+ 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0)
+ static struct file_operations g_proc_file_vectoring_seq_fops = {
+     .owner      = THIS_MODULE,
+     .open       = proc_read_vectoring_seq_open,
+@@ -90,6 +93,15 @@ static struct file_operations g_proc_fil
+     .llseek     = seq_lseek,
+     .release    = single_release,
+ };
+#else
+static struct proc_ops g_proc_file_vectoring_seq_fops = {
+    .proc_open    = proc_read_vectoring_seq_open,
+    .proc_read    = seq_read,
+    .proc_write   = proc_write_vectoring,
+    .proc_lseek   = seq_lseek,
+    .proc_release = single_release,
+};
+#endif
+ 
+ static int proc_read_vectoring_seq_open(struct inode *inode, struct file *file)
+ {
--- a/package/kernel/lantiq/ltq-vectoring/patches/100-cleanup.patch
+++ b/package/kernel/lantiq/ltq-vectoring/patches/100-cleanup.patch
@ -0,0 +1,73 @@
+--- a/src/vectoring/ifxmips_vectoring.c
+++ b/src/vectoring/ifxmips_vectoring.c
+@@ -325,7 +325,7 @@ static int proc_write_dbg(struct file *f
+             else
+                 printk(dbg_enable_mask_str[i] + 1);
+         }
+-        printk("] > /proc/vectoring\n");
+        printk("] > /proc/driver/vectoring\n");
+     }
+ 
+     if ( f_enable )
+@@ -433,11 +433,10 @@ static int __init vectoring_init(void)
+ {
+     struct proc_dir_entry *res;
+ 
+-    res = proc_create("vectoring",
+    res = proc_create("driver/vectoring",
+ 				S_IRUGO|S_IWUSR,
+ 				0,
+ 				&g_proc_file_vectoring_dbg_seq_fops);
+-    printk("res = %p\n", res);
+ 
+     register_netdev_event_handler();
+     g_ptm_net_dev = dev_get_by_name(&init_net, "ptm0");
+@@ -460,7 +459,7 @@ static void __exit vectoring_exit(void)
+ 
+     unregister_netdev_event_handler();
+ 
+-    remove_proc_entry("vectoring", NULL);
+    remove_proc_entry("driver/vectoring", NULL);
+ }
+ 
+ module_init(vectoring_init);
+--- a/src/vectoring/ifxmips_vectoring_test.c
+++ b/src/vectoring/ifxmips_vectoring_test.c
+@@ -79,7 +79,7 @@ static int proc_write_vectoring(struct f
+         }
+     }
+     else
+-        printk("echo send <size> > /proc/eth/vectoring\n");
+        printk("echo send <size> > /proc/driver/vectoring_test\n");
+ 
+     return count;
+ }
+@@ -112,9 +112,7 @@ static __init void proc_file_create(void
+ {
+     struct proc_dir_entry *res;
+ 
+-//    g_proc_dir = proc_mkdir("eth", NULL);
+-
+-    res = proc_create("eth/vectoring",
+    res = proc_create("driver/vectoring_test",
+                             S_IRUGO|S_IWUSR,
+                             g_proc_dir,
+ 			&g_proc_file_vectoring_seq_fops);
+@@ -122,10 +120,7 @@ static __init void proc_file_create(void
+ 
+ static __exit void proc_file_delete(void)
+ {
+-    remove_proc_entry("vectoring",
+-                      g_proc_dir);
+-
+-    remove_proc_entry("eth", NULL);
+    remove_proc_entry("driver/vectoring_test", NULL);
+ }
+ 
+ 
+@@ -151,3 +146,5 @@ static void __exit vectoring_test_exit(v
+ 
+ module_init(vectoring_test_init);
+ module_exit(vectoring_test_exit);
+
+MODULE_LICENSE("GPL");
--- a/package/kernel/lantiq/ltq-vectoring/patches/200-compat.patch
+++ b/package/kernel/lantiq/ltq-vectoring/patches/200-compat.patch
@ -0,0 +1,120 @@
+--- a/src/vectoring/ifxmips_vectoring.c
+++ b/src/vectoring/ifxmips_vectoring.c
+@@ -35,6 +35,8 @@
+ #include <linux/module.h>
+ #include <linux/etherdevice.h>
+ #include <linux/proc_fs.h>
+#include <linux/pkt_sched.h>
+#include <linux/workqueue.h>
+ 
+ /*
+  *  Chip Specific Head File
+@@ -88,6 +90,7 @@ static void dump_skb(struct sk_buff *skb
+ 
+ static void ltq_vectoring_priority(uint32_t priority);
+ 
+static void xmit_work_handler(struct work_struct *);
+ 
+ /*
+  * ####################################
+@@ -118,9 +121,11 @@ struct erb_head {
+ 
+ static struct notifier_block g_netdev_event_handler_nb = {0};
+ static struct net_device *g_ptm_net_dev = NULL;
+-static uint32_t vector_prio = 0;
+static uint32_t vector_prio = TC_PRIO_CONTROL;
+ static int g_dbg_enable = 0;
+ 
+DECLARE_WORK(xmit_work, xmit_work_handler);
+struct sk_buff_head xmit_queue;
+ 
+ 
+ /*
+@@ -129,9 +134,16 @@ static int g_dbg_enable = 0;
+  * ####################################
+  */
+ 
+static void xmit_work_handler(__attribute__((unused)) struct work_struct *work) {
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(&xmit_queue)) != NULL) {
+		dev_queue_xmit(skb);
+	}
+}
+
+ static int mei_dsm_cb_func(unsigned int *p_error_vector)
+ {
+-    int rc, ret;
+     struct sk_buff *skb_list = NULL;
+     struct sk_buff *skb;
+     struct erb_head *erb;
+@@ -179,7 +191,6 @@ static int mei_dsm_cb_func(unsigned int
+         }
+     }
+ 
+-    rc = 0;
+     sent_size = 0;
+     segment_code = 0;
+     while ( (skb = skb_list) != NULL ) {
+@@ -197,24 +208,23 @@ static int mei_dsm_cb_func(unsigned int
+             segment_code |= 0xC0;
+         ((struct erb_head *)skb->data)->segment_code = segment_code;
+ 
+-        skb->cb[13] = 0x5A; /* magic number indicating forcing QId */
+-        skb->cb[15] = 0x00; /* highest priority queue */
+-		skb->priority = vector_prio;
+        skb_reset_mac_header(skb);
+        skb_set_network_header(skb, offsetof(struct erb_head, llc_header));
+        skb->protocol = htons(ETH_P_802_2);
+        skb->priority = vector_prio;
+         skb->dev = g_ptm_net_dev;
+ 
+         dump_skb(skb, ~0, "vectoring TX", 0, 0, 1, 0);
+ 
+-        ret = g_ptm_net_dev->netdev_ops->ndo_start_xmit(skb, g_ptm_net_dev);
+-        if ( rc == 0 )
+-            rc = ret;
+        skb_queue_tail(&xmit_queue, skb);
+        schedule_work(&xmit_work);
+ 
+         segment_code++;
+     }
+ 
+     *p_error_vector = 0;    /* notify DSL firmware that ERB is sent */
+ 
+-    ASSERT(rc == 0, "dev_queue_xmit fail - %d", rc);
+-    return rc;
+    return 0;
+ }
+ static void ltq_vectoring_priority(uint32_t priority)
+ {
+@@ -242,7 +252,7 @@ static int netdev_event_handler(struct n
+         return NOTIFY_DONE;
+ 
+     netif = netdev_notifier_info_to_dev(netdev);
+-    if ( strcmp(netif->name, "ptm0") != 0 )
+    if ( strcmp(netif->name, "dsl0") != 0 )
+         return NOTIFY_DONE;
+ 
+     g_ptm_net_dev = event == NETDEV_REGISTER ? netif : NULL;
+@@ -438,8 +448,10 @@ static int __init vectoring_init(void)
+ 				0,
+ 				&g_proc_file_vectoring_dbg_seq_fops);
+ 
+    skb_queue_head_init(&xmit_queue);
+
+     register_netdev_event_handler();
+-    g_ptm_net_dev = dev_get_by_name(&init_net, "ptm0");
+    g_ptm_net_dev = dev_get_by_name(&init_net, "dsl0");
+     if ( g_ptm_net_dev != NULL )
+         dev_put(g_ptm_net_dev);
+ 
+@@ -459,6 +471,8 @@ static void __exit vectoring_exit(void)
+ 
+     unregister_netdev_event_handler();
+ 
+    flush_scheduled_work();
+
+     remove_proc_entry("driver/vectoring", NULL);
+ }
+ 
--- a/package/kernel/linux/modules/lib.mk
+++ b/package/kernel/linux/modules/lib.mk
@ -109,9 +109,10 @@ define KernelPackage/lib-lzo
  HIDDEN:=1
  FILES:= \
 	$(LINUX_DIR)/crypto/lzo.ko \
+	$(LINUX_DIR)/crypto/lzo-rle.ko \
 	$(LINUX_DIR)/lib/lzo/lzo_compress.ko \
 	$(LINUX_DIR)/lib/lzo/lzo_decompress.ko
-  AUTOLOAD:=$(call AutoProbe,lzo lzo_compress lzo_decompress)
+  AUTOLOAD:=$(call AutoProbe,lzo lzo-rle lzo_compress lzo_decompress)
 endef

 define KernelPackage/lib-lzo/description
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@ -182,6 +182,32 @@ endef
 $(eval $(call KernelPackage,eeprom-at25))


+define KernelPackage/google-firmware
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Google firmware drivers (Coreboot, VPD, Memconsole)
+  KCONFIG:= \
+	CONFIG_GOOGLE_FIRMWARE=y \
+	CONFIG_GOOGLE_COREBOOT_TABLE \
+	CONFIG_GOOGLE_MEMCONSOLE \
+	CONFIG_GOOGLE_MEMCONSOLE_COREBOOT \
+	CONFIG_GOOGLE_VPD
+  FILES:= \
+	  $(LINUX_DIR)/drivers/firmware/google/coreboot_table.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/memconsole.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/memconsole-coreboot.ko \
+	  $(LINUX_DIR)/drivers/firmware/google/vpd-sysfs.ko
+  AUTOLOAD:=$(call AutoProbe,coreboot_table memconsole-coreboot vpd-sysfs)
+endef
+
+define KernelPackage/google-firmware/description
+  Kernel modules for Google firmware drivers. Useful for examining firmware and
+  boot details on devices using a Google bootloader based on Coreboot. Provides
+  files like /sys/firmware/log and /sys/firmware/vpd.
+endef
+
+$(eval $(call KernelPackage,google-firmware))
+
+
 define KernelPackage/gpio-f7188x
  SUBMENU:=$(OTHER_MENU)
  TITLE:=Fintek F718xx/F818xx GPIO Support
--- a/package/kernel/mac80211/patches/subsys/327-mac80211-allow-non-standard-VHT-MCS-10-11.patch
+++ b/package/kernel/mac80211/patches/subsys/327-mac80211-allow-non-standard-VHT-MCS-10-11.patch
@ -0,0 +1,36 @@
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Mon, 3 Jan 2022 09:36:21 +0800
+Subject: [PATCH] mac80211: allow non-standard VHT MCS-10/11
+
+Some AP can possibly try non-standard VHT rate and mac80211 warns and drops
+packets, and leads low TCP throughput.
+
+    Rate marked as a VHT rate but data is invalid: MCS: 10, NSS: 2
+    WARNING: CPU: 1 PID: 7817 at net/mac80211/rx.c:4856 ieee80211_rx_list+0x223/0x2f0 [mac8021
+
+Since commit c27aa56a72b8 ("cfg80211: add VHT rate entries for MCS-10 and MCS-11")
+has added, mac80211 adds this support as well.
+
+After this patch, throughput is good and iw can get the bitrate:
+    rx bitrate:	975.1 MBit/s VHT-MCS 10 80MHz short GI VHT-NSS 2
+or
+    rx bitrate:	1083.3 MBit/s VHT-MCS 11 80MHz short GI VHT-NSS 2
+
+Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1192891
+Reported-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://lore.kernel.org/r/20220103013623.17052-1-pkshih@realtek.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
+@@ -4945,7 +4945,7 @@ void ieee80211_rx_list(struct ieee80211_
+ 				goto drop;
+ 			break;
+ 		case RX_ENC_VHT:
+-			if (WARN_ONCE(status->rate_idx > 9 ||
+			if (WARN_ONCE(status->rate_idx > 11 ||
+ 				      !status->nss ||
+ 				      status->nss > 8,
+ 				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
--- a/package/libs/gettext-full/Makefile
+++ b/package/libs/gettext-full/Makefile
@ -88,6 +88,11 @@ define Build/InstallDev
 	$(SED) '/read dummy/d' $(STAGING_DIR_HOSTPKG)/bin/gettextize
 endef

+define Host/Install
+	$(call Host/Install/Default)
+	$(LN) msgfmt $(STAGING_DIR_HOSTPKG)/bin/gmsgfmt
+endef
+
 define Package/libintl-full/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/libintl.so.* $(1)/usr/lib/
--- a/package/libs/libselinux/Makefile
+++ b/package/libs/libselinux/Makefile
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=libselinux
 PKG_VERSION:=3.3
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/SELinuxProject/selinux/releases/download/$(PKG_VERSION)
@ -18,6 +18,8 @@ PKG_LICENSE:=libselinux-1.0
 PKG_LICENSE_FILES:=LICENSE
 PKG_MAINTAINER:=Thomas Petazzoni <thomas.petazzoni@bootlin.com>

+HOST_BUILD_DEPENDS:=musl-fts/host pcre/host
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk

@ -107,7 +109,8 @@ HOST_LDFLAGS += -Wl,-rpath="$(STAGING_DIR_HOSTPKG)/lib"

 HOST_MAKE_FLAGS += \
 	PREFIX=$(STAGING_DIR_HOSTPKG) \
-	SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib
+	SHLIBDIR=$(STAGING_DIR_HOSTPKG)/lib \
+	FTS_LDLIBS=-lfts

 ifeq ($(CONFIG_USE_MUSL),y)
 MAKE_FLAGS += FTS_LDLIBS=-lfts
--- a/package/libs/musl-fts/Makefile
+++ b/package/libs/musl-fts/Makefile
@ -30,6 +30,7 @@ PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1

 include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/host-build.mk

 define Package/musl-fts
  SECTION:=libs
@ -58,3 +59,4 @@ define Package/musl-fts/install
 endef

 $(eval $(call BuildPackage,musl-fts))
+$(eval $(call HostBuild))
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@ -11,7 +11,7 @@ PKG_NAME:=openssl
 PKG_BASE:=1.1.1
 PKG_BUGFIX:=n
 PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX)
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 PKG_USE_MIPS16:=0

 PKG_BUILD_PARALLEL:=1
@ -66,7 +66,7 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_OPENSSL_WITH_WHIRLPOOL

 include $(INCLUDE_DIR)/package.mk
-include engine.mk
+include $(INCLUDE_DIR)/openssl-engine.mk

 ifneq ($(CONFIG_CCACHE),)
 HOSTCC=$(HOSTCC_NOCACHE)
--- a/package/libs/zlib/Makefile
+++ b/package/libs/zlib/Makefile
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=zlib
 PKG_VERSION:=1.2.11
-PKG_RELEASE:=3
+PKG_RELEASE:=4

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@SF/libpng http://www.zlib.net
--- a/package/libs/zlib/patches/006-fix-compressor-crash-on-certain-inputs.patch
+++ b/package/libs/zlib/patches/006-fix-compressor-crash-on-certain-inputs.patch
@ -0,0 +1,343 @@
+From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001
+From: Mark Adler <madler@alumni.caltech.edu>
+Date: Tue, 17 Apr 2018 22:09:22 -0700
+Subject: [PATCH] Fix a bug that can crash deflate on some input when using
+ Z_FIXED.
+
+This bug was reported by Danilo Ramos of Eideticom, Inc. It has
+lain in wait 13 years before being found! The bug was introduced
+in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
+option forces the use of fixed Huffman codes. For rare inputs with
+a large number of distant matches, the pending buffer into which
+the compressed data is written can overwrite the distance symbol
+table which it overlays. That results in corrupted output due to
+invalid distances, and can result in out-of-bound accesses,
+crashing the application.
+
+The fix here combines the distance buffer and literal/length
+buffers into a single symbol buffer. Now three bytes of pending
+buffer space are opened up for each literal or length/distance
+pair consumed, instead of the previous two bytes. This assures
+that the pending buffer cannot overwrite the symbol table, since
+the maximum fixed code compressed length/distance is 31 bits, and
+since there are four bytes of pending space for every three bytes
+of symbol space.
+---
+ deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++---------------
+ deflate.h | 25 +++++++++----------
+ trees.c   | 50 +++++++++++--------------------------
+ 3 files changed, 79 insertions(+), 70 deletions(-)
+
+diff --git a/deflate.c b/deflate.c
+index 425babc00..19cba873a 100644
+--- a/deflate.c
+++ b/deflate.c
+@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+     int wrap = 1;
+     static const char my_version[] = ZLIB_VERSION;
+ 
+-    ushf *overlay;
+-    /* We overlay pending_buf and d_buf+l_buf. This works since the average
+-     * output size for (length,distance) codes is <= 24 bits.
+-     */
+-
+     if (version == Z_NULL || version[0] != my_version[0] ||
+         stream_size != sizeof(z_stream)) {
+         return Z_VERSION_ERROR;
+@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+ 
+     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
+ 
+-    overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
+-    s->pending_buf = (uchf *) overlay;
+-    s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
+    /* We overlay pending_buf and sym_buf. This works since the average size
+     * for length/distance pairs over any compressed block is assured to be 31
+     * bits or less.
+     *
+     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
+     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
+     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
+     * possible fixed-codes length/distance pair is then 31 bits total.
+     *
+     * sym_buf starts one-fourth of the way into pending_buf. So there are
+     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
+     * in sym_buf is three bytes -- two for the distance and one for the
+     * literal/length. As each symbol is consumed, the pointer to the next
+     * sym_buf value to read moves forward three bytes. From that symbol, up to
+     * 31 bits are written to pending_buf. The closest the written pending_buf
+     * bits gets to the next sym_buf symbol to read is just before the last
+     * code is written. At that time, 31*(n-2) bits have been written, just
+     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
+     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
+     * symbols are written.) The closest the writing gets to what is unread is
+     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
+     * can range from 128 to 32768.
+     *
+     * Therefore, at a minimum, there are 142 bits of space between what is
+     * written and what is read in the overlain buffers, so the symbols cannot
+     * be overwritten by the compressed data. That space is actually 139 bits,
+     * due to the three-bit fixed-code block header.
+     *
+     * That covers the case where either Z_FIXED is specified, forcing fixed
+     * codes, or when the use of fixed codes is chosen, because that choice
+     * results in a smaller compressed block than dynamic codes. That latter
+     * condition then assures that the above analysis also covers all dynamic
+     * blocks. A dynamic-code block will only be chosen to be emitted if it has
+     * fewer bits than a fixed-code block would for the same set of symbols.
+     * Therefore its average symbol length is assured to be less than 31. So
+     * the compressed data for a dynamic block also cannot overwrite the
+     * symbols from which it is being constructed.
+     */
+
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
+    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
+ 
+     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
+         s->pending_buf == Z_NULL) {
+@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+         deflateEnd (strm);
+         return Z_MEM_ERROR;
+     }
+-    s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
+-    s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
+    s->sym_buf = s->pending_buf + s->lit_bufsize;
+    s->sym_end = (s->lit_bufsize - 1) * 3;
+    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
+     * on 16 bit machines and because stored blocks are restricted to
+     * 64K-1 bytes.
+     */
+ 
+     s->level = level;
+     s->strategy = strategy;
+@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
+ 
+     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+     s = strm->state;
+-    if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
+    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+         return Z_BUF_ERROR;
+     do {
+         put = Buf_size - s->bi_valid;
+@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source)
+ #else
+     deflate_state *ds;
+     deflate_state *ss;
+-    ushf *overlay;
+ 
+ 
+     if (deflateStateCheck(source) || dest == Z_NULL) {
+@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source)
+     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
+     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
+     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
+-    overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
+-    ds->pending_buf = (uchf *) overlay;
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
+ 
+     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
+         ds->pending_buf == Z_NULL) {
+@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source)
+     zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
+ 
+     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
+-    ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
+-    ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
+    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
+ 
+     ds->l_desc.dyn_tree = ds->dyn_ltree;
+     ds->d_desc.dyn_tree = ds->dyn_dtree;
+@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
+    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
+    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
+    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
+    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+diff --git a/deflate.h b/deflate.h
+index 23ecdd312..d4cf1a98b 100644
+--- a/deflate.h
+++ b/deflate.h
+@@ -217,7 +217,7 @@ typedef struct internal_state {
+     /* Depth of each subtree used as tie breaker for trees of equal frequency
+      */
+ 
+-    uchf *l_buf;          /* buffer for literals or lengths */
+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
+ 
+     uInt  lit_bufsize;
+     /* Size of match buffer for literals/lengths.  There are 4 reasons for
+@@ -239,13 +239,8 @@ typedef struct internal_state {
+      *   - I can't count above 4
+      */
+ 
+-    uInt last_lit;      /* running index in l_buf */
+-
+-    ushf *d_buf;
+-    /* Buffer for distances. To simplify the code, d_buf and l_buf have
+-     * the same number of elements. To use different lengths, an extra flag
+-     * array would be necessary.
+-     */
+    uInt sym_next;      /* running index in sym_buf */
+    uInt sym_end;       /* symbol table full when sym_next reaches this */
+ 
+     ulg opt_len;        /* bit length of current block with optimal trees */
+     ulg static_len;     /* bit length of current block with static trees */
+@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
+ 
+ # define _tr_tally_lit(s, c, flush) \
+   { uch cc = (c); \
+-    s->d_buf[s->last_lit] = 0; \
+-    s->l_buf[s->last_lit++] = cc; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = cc; \
+     s->dyn_ltree[cc].Freq++; \
+-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
+    }
+ # define _tr_tally_dist(s, distance, length, flush) \
+   { uch len = (uch)(length); \
+     ush dist = (ush)(distance); \
+-    s->d_buf[s->last_lit] = dist; \
+-    s->l_buf[s->last_lit++] = len; \
+    s->sym_buf[s->sym_next++] = dist; \
+    s->sym_buf[s->sym_next++] = dist >> 8; \
+    s->sym_buf[s->sym_next++] = len; \
+     dist--; \
+     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
+     s->dyn_dtree[d_code(dist)].Freq++; \
+-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
+   }
+ #else
+ # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
+diff --git a/trees.c b/trees.c
+index 4f4a65011..decaeb7c3 100644
+--- a/trees.c
+++ b/trees.c
+@@ -416,7 +416,7 @@ local void init_block(s)
+ 
+     s->dyn_ltree[END_BLOCK].Freq = 1;
+     s->opt_len = s->static_len = 0L;
+-    s->last_lit = s->matches = 0;
+    s->sym_next = s->matches = 0;
+ }
+ 
+ #define SMALLEST 1
+@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
+ 
+         Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
+                 opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
+-                s->last_lit));
+                s->sym_next / 3));
+ 
+         if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
+ 
+@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
+     unsigned dist;  /* distance of matched string */
+     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
+ {
+-    s->d_buf[s->last_lit] = (ush)dist;
+-    s->l_buf[s->last_lit++] = (uch)lc;
+    s->sym_buf[s->sym_next++] = dist;
+    s->sym_buf[s->sym_next++] = dist >> 8;
+    s->sym_buf[s->sym_next++] = lc;
+     if (dist == 0) {
+         /* lc is the unmatched char */
+         s->dyn_ltree[lc].Freq++;
+@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
+         s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
+         s->dyn_dtree[d_code(dist)].Freq++;
+     }
+-
+-#ifdef TRUNCATE_BLOCK
+-    /* Try to guess if it is profitable to stop the current block here */
+-    if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
+-        /* Compute an upper bound for the compressed length */
+-        ulg out_length = (ulg)s->last_lit*8L;
+-        ulg in_length = (ulg)((long)s->strstart - s->block_start);
+-        int dcode;
+-        for (dcode = 0; dcode < D_CODES; dcode++) {
+-            out_length += (ulg)s->dyn_dtree[dcode].Freq *
+-                (5L+extra_dbits[dcode]);
+-        }
+-        out_length >>= 3;
+-        Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
+-               s->last_lit, in_length, out_length,
+-               100L - out_length*100L/in_length));
+-        if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
+-    }
+-#endif
+-    return (s->last_lit == s->lit_bufsize-1);
+-    /* We avoid equality with lit_bufsize because of wraparound at 64K
+-     * on 16 bit machines and because stored blocks are restricted to
+-     * 64K-1 bytes.
+-     */
+    return (s->sym_next == s->sym_end);
+ }
+ 
+ /* ===========================================================================
+@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree)
+ {
+     unsigned dist;      /* distance of matched string */
+     int lc;             /* match length or unmatched char (if dist == 0) */
+-    unsigned lx = 0;    /* running index in l_buf */
+    unsigned sx = 0;    /* running index in sym_buf */
+     unsigned code;      /* the code to send */
+     int extra;          /* number of extra bits to send */
+ 
+-    if (s->last_lit != 0) do {
+-        dist = s->d_buf[lx];
+-        lc = s->l_buf[lx++];
+    if (s->sym_next != 0) do {
+        dist = s->sym_buf[sx++] & 0xff;
+        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
+        lc = s->sym_buf[sx++];
+         if (dist == 0) {
+             send_code(s, lc, ltree); /* send a literal byte */
+             Tracecv(isgraph(lc), (stderr," '%c' ", lc));
+@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree)
+             }
+         } /* literal or match pair ? */
+ 
+-        /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
+-        Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
+-               "pendingBuf overflow");
+        /* Check that the overlay between pending_buf and sym_buf is ok: */
+        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
+ 
+-    } while (lx < s->last_lit);
+    } while (sx < s->sym_next);
+ 
+     send_code(s, END_BLOCK, ltree);
+ }
--- a/package/network/config/ltq-vdsl-app/files/dsl_control
+++ b/package/network/config/ltq-vdsl-app/files/dsl_control
@ -95,10 +95,11 @@ tone_vdsl_b="0x1" # B43
 tone_adsl_bv="0x81" # B43 + B43c
 tone_vdsl_bv="0x5" # B43 + V43

-# create ADSL autoboot script. Used for SNR margin tweak
+# create DSL autoboot script. Used for SNR margin tweak and to set MAC address for vectoring error reports
 autoboot_script() {
    echo "[WaitForConfiguration]={
 locs 0 $1
+dsmmcs $2
 }

 [WaitForLinkActivate]={
@ -166,6 +167,12 @@ lowlevel_cfg() {
    0" > /tmp/lowlevel.cfg
 }

+get_macaddr() {
+	local name
+	config_get name $1 name
+	[ "$name" = "dsl0" ] && config_get $2 $1 macaddr
+}
+
 service_triggers() {
 	procd_add_reload_trigger network
 }
@ -183,6 +190,7 @@ start_service() {
 	local mode
 	local lowlevel
 	local snr
+	local macaddr

 	config_load network
 	config_get tone dsl tone
@ -191,6 +199,7 @@ start_service() {
 	config_get xfer_mode dsl xfer_mode
 	config_get line_mode dsl line_mode
 	config_get snr dsl ds_snr_offset
+	config_foreach get_macaddr device macaddr

 	eval "xtse=\"\${xtse_xdsl_$annex}\""

@ -289,11 +298,10 @@ start_service() {
 		lowlevel="-l /tmp/lowlevel.cfg"
 	}

-	[ -z "${snr}" ] || {
-	    # for SNR offset setting
-	    autoboot_script "$snr"
+	[ -z "${snr}" ] && snr=0
+	[ -z "${macaddr}" ] && macaddr="00:00:00:00:00:00"
+	autoboot_script "$snr" "$macaddr"
 	autoboot="-a /tmp/dsl.scr -A /tmp/dsl.scr"
-	}

 	procd_open_instance
 	procd_set_param command /sbin/vdsl_cpe_control \
--- a/package/network/config/qosify/Makefile
+++ b/package/network/config/qosify/Makefile
@ -11,9 +11,9 @@ include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=qosify
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/qosify.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-03-06
-PKG_SOURCE_VERSION:=f13b67c9a786567df240a8f3f608e2724ddaadba
-PKG_MIRROR_HASH:=3d8629e711e46a6be79a46a6394165fd1761687f24b8ed954dc4f16f177cd90f
+PKG_SOURCE_DATE:=2022-03-22
+PKG_SOURCE_VERSION:=57c7817f91c2ff2f247b2d7eb8554e861c4aec33
+PKG_MIRROR_HASH:=409f7db13a36334557de861a016a8d9f241070b2bbf6f738e992281b36f41cd4
 PKG_RELEASE:=$(AUTORELEASE)

 PKG_LICENSE:=GPL-2.0
--- a/package/network/services/odhcpd/Makefile
+++ b/package/network/services/odhcpd/Makefile
@ -12,9 +12,9 @@ PKG_RELEASE:=$(AUTORELEASE)

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_SOURCE_DATE:=2021-08-11
-PKG_SOURCE_VERSION:=01b4e6046f10e21809c3f380f2d33bf3fe59698d
-PKG_MIRROR_HASH:=419bbc1dd159c25852da4abdcb9ffee8d72d12b8b998ff14e343d5f2455d8d2a
+PKG_SOURCE_DATE:=2022-03-22
+PKG_SOURCE_VERSION:=860ca900e41c5d0f98cc85e67b39977f6f2cb355
+PKG_MIRROR_HASH:=555712a1e25d197e52808a0d5e42bf0d48a8b61fe7c8aad1a02a7c09f0b8b8a3

 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
--- a/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
+++ b/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
@ -105,10 +105,12 @@ proto_qmi_setup() {
 			}
 		}
 	else
-		. /usr/share/libubox/jshn.sh
-		json_load "$(uqmi -s -d "$device" --get-pin-status)" 2>&1 | grep -q Failed &&
+		json_load "$(uqmi -s -d "$device" --get-pin-status)"
+		json_get_var pin1_status pin1_status
+		if [ -z "$pin1_status" ]; then
 			json_load "$(uqmi -s -d "$device" --uim-get-sim-state)"
 			json_get_var pin1_status pin1_status
+		fi
 		json_get_var pin1_verify_tries pin1_verify_tries

 		case "$pin1_status" in
@ -152,6 +154,7 @@ proto_qmi_setup() {
 				return 1
 			;;
 		esac
+		json_cleanup
 	fi

 	if [ -n "$plmn" ]; then
@ -247,7 +250,8 @@ proto_qmi_setup() {

 	echo "Starting network $interface"

-	pdptype=$(echo "$pdptype" | awk '{print tolower($0)}')
+	pdptype="$(echo "$pdptype" | awk '{print tolower($0)}')"
+
 	[ "$pdptype" = "ip" -o "$pdptype" = "ipv6" -o "$pdptype" = "ipv4v6" ] || pdptype="ip"

 	if [ "$pdptype" = "ip" ]; then
--- a/package/system/gpio-cdev/nu801/Makefile
+++ b/package/system/gpio-cdev/nu801/Makefile
@ -0,0 +1,39 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nu801
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/chunkeey/nu801.git
+PKG_SOURCE_VERSION:=d9942c0ceb949080b93366a9431028de3608e535
+
+PKG_MAINTAINER:=Christian Lamparter <chunkeey@gmail.com>
+PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE_FILES:=LICENSE
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/nu801
+  SECTION:=utils
+  CATEGORY:=Utilities
+  SUBMENU:=Userspace GPIO Drivers
+  DEPENDS:=@TARGET_x86 +kmod-leds-uleds
+  KCONFIG:=CONFIG_GPIO_CDEV=y
+  TITLE:=NU801 LED Driver
+endef
+
+define Package/nu801/description
+This package contains a userspace driver to power the NUMEN Tech. NU801 LED Driver.
+endef
+
+define Package/nu801/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/nu801 $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/nu801.init $(1)/etc/init.d/nu801
+endef
+
+$(eval $(call BuildPackage,nu801))
--- a/package/system/gpio-cdev/nu801/files/nu801.init
+++ b/package/system/gpio-cdev/nu801/files/nu801.init
@ -0,0 +1,14 @@
+#!/bin/sh /etc/rc.common
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+START=11
+
+boot() {
+	. /lib/functions.sh
+	/usr/sbin/nu801 "$(board_name)"
+
+	# Because this is a userspace driver, we need to trigger diag.sh after
+	# we start the driver, but before boot is complete so we blink.
+	. /etc/diag.sh
+	set_state preinit_regular
+}
--- a/scripts/mkits.sh
+++ b/scripts/mkits.sh
@ -137,7 +137,7 @@ fi
 if [ -n "${ROOTFS}" ]; then
 	dd if="${ROOTFS}" of="${ROOTFS}.pagesync" bs=4096 conv=sync
 	ROOTFS_NODE="
-		rootfs-$ROOTFSNUM {
+		rootfs${REFERENCE_CHAR}$ROOTFSNUM {
 			description = \"${ARCH_UPPER} OpenWrt ${DEVICE} rootfs\";
 			${COMPATIBLE_PROP}
 			data = /incbin/(\"${ROOTFS}.pagesync\");
--- a/target/imagebuilder/Makefile
+++ b/target/imagebuilder/Makefile
@ -78,7 +78,7 @@ ifneq ($(CONFIG_SIGNATURE_CHECK),)
 	$(CP) -L $(STAGING_DIR_ROOT)/usr/sbin/opkg-key $(PKG_BUILD_DIR)/scripts/
 endif

-	$(CP) $(TOPDIR)/target/linux $(PKG_BUILD_DIR)/target/
+	$(CP) -L $(TOPDIR)/target/linux $(PKG_BUILD_DIR)/target/
 	if [ -d $(TOPDIR)/staging_dir/host/lib/grub ]; then \
 		$(CP) $(TOPDIR)/staging_dir/host/lib/grub/ $(PKG_BUILD_DIR)/staging_dir/host/lib; \
 	fi
--- a/target/linux/apm821xx/patches-5.10/150-ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch
+++ b/target/linux/apm821xx/patches-5.10/150-ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch
@ -0,0 +1,65 @@
+From ba068938e629eb1a8b423a54405233e685cedb78 Mon Sep 17 00:00:00 2001
+Message-Id: <ba068938e629eb1a8b423a54405233e685cedb78.1647594132.git.chunkeey@gmail.com>
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Thu, 17 Mar 2022 21:29:28 +0100
+Subject: [PATCH v1 1/2] ata: sata_dwc_460ex: Fix crash due to OOB write
+To: linux-ide@vger.kernel.org
+Cc: Damien Le Moal <damien.lemoal@opensource.wdc.com>,
+    Jens Axboe <axboe@kernel.dk>,
+    Tejun Heo <tj@kernel.org>,
+    Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+the driver uses libata's "tag" values from in various arrays.
+Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32,
+the value of the SATA_DWC_QCMD_MAX needs to be bumped to 33.
+
+Otherwise ATA_TAG_INTERNAL cause a crash like this:
+
+| BUG: Kernel NULL pointer dereference at 0x00000000
+| Faulting instruction address: 0xc03ed4b8
+| Oops: Kernel access of bad area, sig: 11 [#1]
+| BE PAGE_SIZE=4K PowerPC 44x Platform
+| CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0
+| NIP:  c03ed4b8 LR: c03d27e8 CTR: c03ed36c
+| REGS: cfa59950 TRAP: 0300   Not tainted  (5.4.163)
+| MSR:  00021000 <CE,ME>  CR: 42000222  XER: 00000000
+| DEAR: 00000000 ESR: 00000000
+| GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...]
+| [..]
+| NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254
+| LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc
+| Call Trace:
+| [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable)
+| [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc
+| [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524
+| [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0
+| [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204
+| [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130
+| [...]
+
+this is because sata_dwc_dma_xfer_complete() NULLs the
+dma_pending's next neighbour "chan" (a *dma_chan struct) in
+this '32' case right here (line ~735):
+> hsdevp->dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE;
+
+Then the next time, a dma gets issued; dma_dwc_xfer_setup() passes
+the NULL'd hsdevp->chan to the dmaengine_slave_config() which then
+causes the crash.
+
+Reported-by: ticerex (OpenWrt Forum)
+Fixes: 28361c403683c ("libata: add extra internal command")
+Cc: stable@kernel.org # 4.18+
+Link: https://forum.openwrt.org/t/my-book-live-duo-reboot-loop/122464
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
+@@ -145,7 +145,7 @@ struct sata_dwc_device {
+ #endif
+ };
+ 
+-#define SATA_DWC_QCMD_MAX	32
+#define SATA_DWC_QCMD_MAX	33
+ 
+ struct sata_dwc_device_port {
+ 	struct sata_dwc_device	*hsdev;
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi-ap-outdoor-plus.dts
@ -7,6 +7,7 @@
 	model = "Ubiquiti UniFi AP Outdoor+";

 	aliases {
+		label-mac-device = &wifi;
 		led-boot = &led_white;
 		led-failsafe = &led_white;
 		led-running = &led_blue;
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi.dts
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi.dts
@ -4,9 +4,10 @@

 / {
 	compatible = "ubnt,unifi", "qca,ar7241";
-	model = "Ubiquiti UniFi";
+	model = "Ubiquiti UniFi AP";

 	aliases {
+		label-mac-device = &eth0;
 		led-boot = &led_dome_green;
 		led-failsafe = &led_dome_green;
 		led-running = &led_dome_green;
--- a/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi
+++ b/target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi
@ -6,10 +6,6 @@
 #include <dt-bindings/input/input.h>

 / {
-	aliases {
-		label-mac-device = &wifi;
-	};
-
 	extosc: ref {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
--- a/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts
+++ b/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts
@ -152,19 +152,30 @@

 	phy0: ethernet-phy@0 {
 		reg = <0>;
+		eee-broken-100tx;
+		eee-broken-1000t;
 	};
 };

 &eth0 {
 	status = "okay";

-	pll-data = <0x06000000 0x00000101 0x00001313>;
+	pll-data = <0x02000000 0x00000101 0x00001313>;

 	nvmem-cells = <&macaddr_art_0>;
 	nvmem-cell-names = "mac-address";

 	phy-mode = "rgmii-id";
 	phy-handle = <&phy0>;
+
+	gmac-config {
+		device = <&gmac>;
+		rgmii-gmac0 = <1>;
+		rxdv-delay = <3>;
+		rxd-delay = <3>;
+		txen-delay = <0>;
+		txd-delay = <0>;
+	};
 };

 &art {
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@ -712,6 +712,7 @@ define Device/tplink_tl-wr1043nd-v4
  DEVICE_VARIANT := v4
  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport
  TPLINK_HWID := 0x10430004
+  TPLINK_HWREV := 0x1
  TPLINK_BOARD_ID := TLWR1043NDV4
  SUPPORTED_DEVICES += tl-wr1043nd-v4
 endef
--- a/target/linux/ath79/image/generic-ubnt.mk
+++ b/target/linux/ath79/image/generic-ubnt.mk
@ -419,7 +419,7 @@ TARGET_DEVICES += ubnt_routerstation-pro

 define Device/ubnt_unifi
  $(Device/ubnt-bz)
-  DEVICE_MODEL := UniFi
+  DEVICE_MODEL := UniFi AP
  SUPPORTED_DEVICES += unifi
 endef
 TARGET_DEVICES += ubnt_unifi
--- a/target/linux/generic/backport-5.10/738-v5.14-01-net-dsa-qca8k-fix-an-endian-bug-in-qca8k-get-ethtool.patch
+++ b/target/linux/generic/backport-5.10/738-v5.14-01-net-dsa-qca8k-fix-an-endian-bug-in-qca8k-get-ethtool.patch
@ -1,4 +1,4 @@
-aFrom aa3d020b22cb844ab7bdbb9e5d861a64666e2b74 Mon Sep 17 00:00:00 2001
+From aa3d020b22cb844ab7bdbb9e5d861a64666e2b74 Mon Sep 17 00:00:00 2001
 From: Dan Carpenter <dan.carpenter@oracle.com>
 Date: Wed, 9 Jun 2021 12:52:12 +0300
 Subject: [PATCH] net: dsa: qca8k: fix an endian bug in
--- a/target/linux/generic/backport-5.10/774-v5.15-1-igc-remove-_I_PHY_ID-checking.patch
+++ b/target/linux/generic/backport-5.10/774-v5.15-1-igc-remove-_I_PHY_ID-checking.patch
@ -0,0 +1,73 @@
+From 7c496de538eebd8212dc2a3c9a468386b264d0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Neftin <sasha.neftin@intel.com>
+Date: Wed, 7 Jul 2021 08:14:40 +0300
+Subject: igc: Remove _I_PHY_ID checking
+
+i225 devices have only one PHY vendor. There is no point checking
+_I_PHY_ID during the link establishment and auto-negotiation process.
+This patch comes to clean up these pointless checkings.
+
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+---
+ drivers/net/ethernet/intel/igc/igc_base.c | 10 +---------
+ drivers/net/ethernet/intel/igc/igc_main.c |  3 +--
+ drivers/net/ethernet/intel/igc/igc_phy.c  |  6 ++----
+ 3 files changed, 4 insertions(+), 15 deletions(-)
+
+(limited to 'drivers/net/ethernet/intel/igc')
+
+--- a/drivers/net/ethernet/intel/igc/igc_base.c
+++ b/drivers/net/ethernet/intel/igc/igc_base.c
+@@ -187,15 +187,7 @@ static s32 igc_init_phy_params_base(stru
+ 
+ 	igc_check_for_copper_link(hw);
+ 
+-	/* Verify phy id and set remaining function pointers */
+-	switch (phy->id) {
+-	case I225_I_PHY_ID:
+-		phy->type	= igc_phy_i225;
+-		break;
+-	default:
+-		ret_val = -IGC_ERR_PHY;
+-		goto out;
+-	}
+	phy->type = igc_phy_i225;
+ 
+ out:
+ 	return ret_val;
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -4189,8 +4189,7 @@ bool igc_has_link(struct igc_adapter *ad
+ 		break;
+ 	}
+ 
+-	if (hw->mac.type == igc_i225 &&
+-	    hw->phy.id == I225_I_PHY_ID) {
+	if (hw->mac.type == igc_i225) {
+ 		if (!netif_carrier_ok(adapter->netdev)) {
+ 			adapter->flags &= ~IGC_FLAG_NEED_LINK_UPDATE;
+ 		} else if (!(adapter->flags & IGC_FLAG_NEED_LINK_UPDATE)) {
+--- a/drivers/net/ethernet/intel/igc/igc_phy.c
+++ b/drivers/net/ethernet/intel/igc/igc_phy.c
+@@ -249,8 +249,7 @@ static s32 igc_phy_setup_autoneg(struct
+ 			return ret_val;
+ 	}
+ 
+-	if ((phy->autoneg_mask & ADVERTISE_2500_FULL) &&
+-	    hw->phy.id == I225_I_PHY_ID) {
+	if (phy->autoneg_mask & ADVERTISE_2500_FULL) {
+ 		/* Read the MULTI GBT AN Control Register - reg 7.32 */
+ 		ret_val = phy->ops.read_reg(hw, (STANDARD_AN_REG_MASK <<
+ 					    MMD_DEVADDR_SHIFT) |
+@@ -390,8 +389,7 @@ static s32 igc_phy_setup_autoneg(struct
+ 		ret_val = phy->ops.write_reg(hw, PHY_1000T_CTRL,
+ 					     mii_1000t_ctrl_reg);
+ 
+-	if ((phy->autoneg_mask & ADVERTISE_2500_FULL) &&
+-	    hw->phy.id == I225_I_PHY_ID)
+	if (phy->autoneg_mask & ADVERTISE_2500_FULL)
+ 		ret_val = phy->ops.write_reg(hw,
+ 					     (STANDARD_AN_REG_MASK <<
+ 					     MMD_DEVADDR_SHIFT) |
--- a/target/linux/generic/backport-5.10/774-v5.15-2-igc-remove-phy-type-checking.patch
+++ b/target/linux/generic/backport-5.10/774-v5.15-2-igc-remove-phy-type-checking.patch
@ -0,0 +1,43 @@
+From 47bca7de6a4fb8dcb564c7ca14d885c91ed19e03 Mon Sep 17 00:00:00 2001
+From: Sasha Neftin <sasha.neftin@intel.com>
+Date: Sat, 10 Jul 2021 20:57:50 +0300
+Subject: igc: Remove phy->type checking
+
+i225 devices have only one phy->type: copper. There is no point checking
+phy->type during the igc_has_link method from the watchdog that
+invoked every 2 seconds.
+This patch comes to clean up these pointless checkings.
+
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+(limited to 'drivers/net/ethernet/intel/igc')
+
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -4177,17 +4177,10 @@ bool igc_has_link(struct igc_adapter *ad
+ 	 * false until the igc_check_for_link establishes link
+ 	 * for copper adapters ONLY
+ 	 */
+-	switch (hw->phy.media_type) {
+-	case igc_media_type_copper:
+-		if (!hw->mac.get_link_status)
+-			return true;
+-		hw->mac.ops.check_for_link(hw);
+-		link_active = !hw->mac.get_link_status;
+-		break;
+-	default:
+-	case igc_media_type_unknown:
+-		break;
+-	}
+	if (!hw->mac.get_link_status)
+		return true;
+	hw->mac.ops.check_for_link(hw);
+	link_active = !hw->mac.get_link_status;
+ 
+ 	if (hw->mac.type == igc_i225) {
+ 		if (!netif_carrier_ok(adapter->netdev)) {
--- a/target/linux/generic/backport-5.10/780-v5.11-net-usb-r8152-Provide-missing-documentation-for-some.patch
+++ b/target/linux/generic/backport-5.10/780-v5.11-net-usb-r8152-Provide-missing-documentation-for-some.patch
--- a/target/linux/generic/backport-5.10/781-v5.11-net-usb-r8152-Fix-a-couple-of-spelling-errors-in-fw_.patch
+++ b/target/linux/generic/backport-5.10/781-v5.11-net-usb-r8152-Fix-a-couple-of-spelling-errors-in-fw_.patch
--- a/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch
+++ b/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch
--- a/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch
+++ b/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch
--- a/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch
+++ b/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch
--- a/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch
+++ b/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch
--- a/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch
+++ b/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch
--- a/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch
+++ b/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch
--- a/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch
+++ b/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch
--- a/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch
+++ b/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch
--- a/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch
+++ b/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch
--- a/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch
+++ b/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch
--- a/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch
+++ b/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch
--- a/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch
+++ b/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch
--- a/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch
+++ b/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch
--- a/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch
+++ b/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch
--- a/target/linux/generic/config-5.10
+++ b/target/linux/generic/config-5.10
@ -419,6 +419,7 @@ CONFIG_ARM_GIC_MAX_NR=1
 # CONFIG_ASUS_WIRELESS is not set
 # CONFIG_ASYMMETRIC_KEY_TYPE is not set
 # CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not set
+# CONFIG_ASYMMETRIC_TPM_KEY_SUBTYPE is not set
 # CONFIG_ASYNC_RAID6_TEST is not set
 # CONFIG_ASYNC_TX_DMA is not set
 # CONFIG_AT76C50X_USB is not set
@ -2070,7 +2071,13 @@ CONFIG_GENERIC_VDSO_TIME_NS=y
 # CONFIG_GLOB_SELFTEST is not set
 # CONFIG_GNSS is not set
 # CONFIG_GOLDFISH is not set
+# CONFIG_GOOGLE_COREBOOT_TABLE is not set
 # CONFIG_GOOGLE_FIRMWARE is not set
+# CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT is not set
+# CONFIG_GOOGLE_MEMCONSOLE_COREBOOT is not set
+# CONFIG_GOOGLE_MEMCONSOLE_X86_LEGACY is not set
+# CONFIG_GOOGLE_SMI is not set
+# CONFIG_GOOGLE_VPD is not set
 # CONFIG_GP2AP002 is not set
 # CONFIG_GP2AP020A00F is not set
 # CONFIG_GPD_POCKET_FAN is not set
@ -4621,7 +4628,7 @@ CONFIG_PROC_SYSCTL=y
 # CONFIG_PSTORE is not set
 # CONFIG_PSTORE_842_COMPRESS is not set
 # CONFIG_PSTORE_COMPRESS is not set
-# CONFIG_PSTORE_COMPRESS_DEFAULT="deflate"
+# CONFIG_PSTORE_COMPRESS_DEFAULT is not set
 # CONFIG_PSTORE_CONSOLE is not set
 # CONFIG_PSTORE_DEFLATE_COMPRESS is not set
 # CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT is not set
--- a/target/linux/generic/files/block/partitions/fit.c
+++ b/target/linux/generic/files/block/partitions/fit.c
@ -87,6 +87,12 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		config_description_len, config_loadables_len;
 	sector_t start_sect, nr_sects;
 	size_t label_min;
+	struct device_node *np = NULL;
+	const char *bootconf;
+	const char *loadable;
+	const char *select_rootfs = NULL;
+	bool found;
+	int loadables_rem_len, loadable_len;

 	if (fit_start_sector % (1<<(PAGE_SHIFT - SECTOR_SHIFT)))
 		return -ERANGE;
@ -115,7 +121,6 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		dsectors = (dsectors>sectors)?sectors:dsectors;

 	dsize = dsectors << SECTOR_SHIFT;
-
 	size = fdt_totalsize(init_fit);

 	/* silently skip non-external-data legacy FIT images */
@ -135,6 +140,12 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 	if (!fit)
 		return -ENOMEM;

+	np = of_find_node_by_path("/chosen");
+	if (np)
+		bootconf = of_get_property(np, "bootconf", NULL);
+	else
+		bootconf = NULL;
+
 	config = fdt_path_offset(fit, FIT_CONFS_PATH);
 	if (config < 0) {
 		printk(KERN_ERR "FIT: Cannot find %s node: %d\n", FIT_CONFS_PATH, images);
@ -144,15 +155,15 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,

 	config_default = fdt_getprop(fit, config, FIT_DEFAULT_PROP, &config_default_len);

-	if (!config_default) {
+	if (!config_default && !bootconf) {
 		printk(KERN_ERR "FIT: Cannot find default configuration\n");
 		ret = -ENOENT;
 		goto ret_out;
 	}

-	node = fdt_subnode_offset(fit, config, config_default);
+	node = fdt_subnode_offset(fit, config, bootconf?:config_default);
 	if (node < 0) {
-		printk(KERN_ERR "FIT: Cannot find %s node: %d\n", config_default, node);
+		printk(KERN_ERR "FIT: Cannot find %s node: %d\n", bootconf?:config_default, node);
 		ret = -ENOENT;
 		goto ret_out;
 	}
@ -160,9 +171,16 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 	config_description = fdt_getprop(fit, node, FIT_DESC_PROP, &config_description_len);
 	config_loadables = fdt_getprop(fit, node, FIT_LOADABLE_PROP, &config_loadables_len);

-	printk(KERN_DEBUG "FIT: Default configuration: \"%s\"%s%s%s\n", config_default,
+	printk(KERN_DEBUG "FIT: %s configuration: \"%s\"%s%s%s\n",
+		bootconf?"Selected":"Default", bootconf?:config_default,
 		config_description?" (":"", config_description?:"", config_description?")":"");

+	if (!config_loadables || !config_loadables_len) {
+		printk(KERN_ERR "FIT: No loadables configured in \"%s\"\n", bootconf?:config_default);
+		ret = -ENOENT;
+		goto ret_out;
+	}
+
 	images = fdt_path_offset(fit, FIT_IMAGES_PATH);
 	if (images < 0) {
 		printk(KERN_ERR "FIT: Cannot find %s node: %d\n", FIT_IMAGES_PATH, images);
@ -199,6 +217,22 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		if (strcmp(image_type, FIT_FILESYSTEM_PROP))
 			continue;

+		/* check if sub-image is part of configured loadables */
+		found = false;
+		loadable = config_loadables;
+		loadables_rem_len = config_loadables_len;
+		while (loadables_rem_len > 1) {
+			loadable_len = strnlen(loadable, loadables_rem_len - 1) + 1;
+			loadables_rem_len -= loadable_len;
+			if (!strncmp(image_name, loadable, loadable_len)) {
+				found = true;
+				break;
+			}
+			loadable += loadable_len;
+		}
+		if (!found)
+			continue;
+
 		if (image_pos & ((1 << PAGE_SHIFT)-1)) {
 			printk(KERN_ERR "FIT: image %s start not aligned to page boundaries, skipping\n", image_name);
 			continue;
@ -219,7 +253,8 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		}

 		put_partition(state, ++(*slot), fit_start_sector + start_sect, nr_sects);
-		state->parts[*slot].flags = 0;
+		state->parts[*slot].flags = ADDPART_FLAG_READONLY;
+		state->parts[*slot].has_info = true;
 		info = &state->parts[*slot].info;

 		label_min = min_t(int, sizeof(info->volname) - 1, image_name_len);
@ -229,14 +264,16 @@ int parse_fit_partitions(struct parsed_partitions *state, u64 fit_start_sector,
 		snprintf(tmp, sizeof(tmp), "(%s)", info->volname);
 		strlcat(state->pp_buf, tmp, PAGE_SIZE);

-		state->parts[*slot].has_info = true;
-		state->parts[*slot].flags |= ADDPART_FLAG_READONLY;
-		if (config_loadables && !strcmp(image_name, config_loadables)) {
-			printk(KERN_DEBUG "FIT: selecting configured loadable \"%s\" to be root filesystem\n", image_name);
+		/* Mark first loadable listed to be mounted as rootfs */
+		if (!strcmp(image_name, config_loadables)) {
+			select_rootfs = image_name;
 			state->parts[*slot].flags |= ADDPART_FLAG_ROOTDEV;
 		}
 	}

+	if (select_rootfs)
+		printk(KERN_DEBUG "FIT: selecting configured loadable \"%s\" to be root filesystem\n", select_rootfs);
+
 	if (add_remain && (imgmaxsect + MIN_FREE_SECT) < dsectors) {
 		put_partition(state, ++(*slot), fit_start_sector + imgmaxsect, dsectors - imgmaxsect);
 		state->parts[*slot].flags = 0;
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
@ -256,9 +256,11 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
 	 * last external data refernced.
 	 */
 	if (fit_size > 0x1000) {
+		enum mtdsplit_part_type type;
+
 		/* Search for the rootfs partition after the FIT image */
 		ret = mtd_find_rootfs_from(mtd, fit_offset + fit_size, mtd->size,
-					   &rootfs_offset, NULL);
+					   &rootfs_offset, &type);
 		if (ret) {
 			pr_info("no rootfs found after FIT image in \"%s\"\n",
 				mtd->name);
@ -275,6 +277,9 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
 		parts[0].offset = fit_offset;
 		parts[0].size = mtd_rounddown_to_eb(fit_size, mtd) + mtd->erasesize;

+		if (type == MTDSPLIT_PART_TYPE_UBI)
+			parts[1].name = UBI_PART_NAME;
+		else
 			parts[1].name = ROOTFS_PART_NAME;
 		parts[1].offset = rootfs_offset;
 		parts[1].size = rootfs_size;
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
@ -0,0 +1,131 @@
+#ifndef __MTK_BMT_PRIV_H
+#define __MTK_BMT_PRIV_H
+
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/mtk_bmt.h>
+#include <linux/debugfs.h>
+
+#define MAIN_SIGNATURE_OFFSET   0
+#define OOB_SIGNATURE_OFFSET    1
+
+#define BBT_LOG(fmt, ...) pr_debug("[BBT][%s|%d] "fmt"\n", __func__, __LINE__, ##__VA_ARGS__)
+
+struct mtk_bmt_ops {
+	char *sig;
+	unsigned int sig_len;
+	int (*init)(struct device_node *np);
+	bool (*remap_block)(u16 block, u16 mapped_block, int copy_len);
+	void (*unmap_block)(u16 block);
+	int (*get_mapping_block)(int block);
+	int (*debug)(void *data, u64 val);
+};
+
+struct bbbt;
+struct nmbm_instance;
+
+struct bmt_desc {
+	struct mtd_info *mtd;
+	unsigned char *bbt_buf;
+	unsigned char *data_buf;
+
+	int (*_read_oob) (struct mtd_info *mtd, loff_t from,
+			  struct mtd_oob_ops *ops);
+	int (*_write_oob) (struct mtd_info *mtd, loff_t to,
+			   struct mtd_oob_ops *ops);
+	int (*_erase) (struct mtd_info *mtd, struct erase_info *instr);
+	int (*_block_isbad) (struct mtd_info *mtd, loff_t ofs);
+	int (*_block_markbad) (struct mtd_info *mtd, loff_t ofs);
+
+	const struct mtk_bmt_ops *ops;
+
+	union {
+		struct bbbt *bbt;
+		struct nmbm_instance *ni;
+	};
+
+	struct dentry *debugfs_dir;
+
+	u32 table_size;
+	u32 pg_size;
+	u32 blk_size;
+	u16 pg_shift;
+	u16 blk_shift;
+	/* bbt logical address */
+	u16 pool_lba;
+	/* bbt physical address */
+	u16 pool_pba;
+	/* Maximum count of bad blocks that the vendor guaranteed */
+	u16 bb_max;
+	/* Total blocks of the Nand Chip */
+	u16 total_blks;
+	/* The block(n) BMT is located at (bmt_tbl[n]) */
+	u16 bmt_blk_idx;
+	/* How many pages needs to store 'struct bbbt' */
+	u32 bmt_pgs;
+
+	const __be32 *remap_range;
+	int remap_range_len;
+
+	/* to compensate for driver level remapping */
+	u8 oob_offset;
+};
+
+extern struct bmt_desc bmtd;
+extern const struct mtk_bmt_ops mtk_bmt_v2_ops;
+extern const struct mtk_bmt_ops mtk_bmt_bbt_ops;
+extern const struct mtk_bmt_ops mtk_bmt_nmbm_ops;
+
+static inline u32 blk_pg(u16 block)
+{
+	return (u32)(block << (bmtd.blk_shift - bmtd.pg_shift));
+}
+
+static inline int
+bbt_nand_read(u32 page, unsigned char *dat, int dat_len,
+	      unsigned char *fdm, int fdm_len)
+{
+	struct mtd_oob_ops ops = {
+		.mode = MTD_OPS_PLACE_OOB,
+		.ooboffs = bmtd.oob_offset,
+		.oobbuf = fdm,
+		.ooblen = fdm_len,
+		.datbuf = dat,
+		.len = dat_len,
+	};
+
+	return bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+}
+
+static inline int bbt_nand_erase(u16 block)
+{
+	struct mtd_info *mtd = bmtd.mtd;
+	struct erase_info instr = {
+		.addr = (loff_t)block << bmtd.blk_shift,
+		.len = bmtd.blk_size,
+	};
+
+	return bmtd._erase(mtd, &instr);
+}
+
+static inline int write_bmt(u16 block, unsigned char *dat)
+{
+	struct mtd_oob_ops ops = {
+		.mode = MTD_OPS_PLACE_OOB,
+		.ooboffs = OOB_SIGNATURE_OFFSET + bmtd.oob_offset,
+		.oobbuf = bmtd.ops->sig,
+		.ooblen = bmtd.ops->sig_len,
+		.datbuf = dat,
+		.len = bmtd.bmt_pgs << bmtd.pg_shift,
+	};
+	loff_t addr = (loff_t)block << bmtd.blk_shift;
+
+	return bmtd._write_oob(bmtd.mtd, addr, &ops);
+}
+
+int bbt_nand_copy(u16 dest_blk, u16 src_blk, loff_t max_offset);
+bool mapping_block_in_range(int block, int *start, int *end);
+
+#endif
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_bbt.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_bbt.c
@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+ * Copyright (c) 2020-2022 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include "mtk_bmt.h"
+
+static bool
+bbt_block_is_bad(u16 block)
+{
+	u8 cur = bmtd.bbt_buf[block / 4];
+
+	return cur & (3 << ((block % 4) * 2));
+}
+
+static void
+bbt_set_block_state(u16 block, bool bad)
+{
+	u8 mask = (3 << ((block % 4) * 2));
+
+	if (bad)
+		bmtd.bbt_buf[block / 4] |= mask;
+	else
+		bmtd.bbt_buf[block / 4] &= ~mask;
+
+	bbt_nand_erase(bmtd.bmt_blk_idx);
+	write_bmt(bmtd.bmt_blk_idx, bmtd.bbt_buf);
+}
+
+static int
+get_mapping_block_index_bbt(int block)
+{
+	int start, end, ofs;
+	int bad_blocks = 0;
+	int i;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return block;
+
+	start >>= bmtd.blk_shift;
+	end >>= bmtd.blk_shift;
+	/* skip bad blocks within the mapping range */
+	ofs = block - start;
+	for (i = start; i < end; i++) {
+		if (bbt_block_is_bad(i))
+			bad_blocks++;
+		else if (ofs)
+			ofs--;
+		else
+			break;
+	}
+
+	if (i < end)
+		return i;
+
+	/* when overflowing, remap remaining blocks to bad ones */
+	for (i = end - 1; bad_blocks > 0; i--) {
+		if (!bbt_block_is_bad(i))
+			continue;
+
+		bad_blocks--;
+		if (bad_blocks <= ofs)
+			return i;
+	}
+
+	return block;
+}
+
+static bool remap_block_bbt(u16 block, u16 mapped_blk, int copy_len)
+{
+	int start, end;
+	u16 new_blk;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return false;
+
+	bbt_set_block_state(mapped_blk, true);
+
+	new_blk = get_mapping_block_index_bbt(block);
+	bbt_nand_erase(new_blk);
+	if (copy_len > 0)
+		bbt_nand_copy(new_blk, mapped_blk, copy_len);
+
+	return true;
+}
+
+static void
+unmap_block_bbt(u16 block)
+{
+	bbt_set_block_state(block, false);
+}
+
+static int
+mtk_bmt_read_bbt(void)
+{
+	u8 oob_buf[8];
+	int i;
+
+	for (i = bmtd.total_blks - 1; i >= bmtd.total_blks - 5; i--) {
+		u32 page = i << (bmtd.blk_shift - bmtd.pg_shift);
+
+		if (bbt_nand_read(page, bmtd.bbt_buf, bmtd.pg_size,
+				  oob_buf, sizeof(oob_buf))) {
+			pr_info("read_bbt: could not read block %d\n", i);
+			continue;
+		}
+
+		if (oob_buf[0] != 0xff) {
+			pr_info("read_bbt: bad block at %d\n", i);
+			continue;
+		}
+
+		if (memcmp(&oob_buf[1], "mtknand", 7) != 0) {
+			pr_info("read_bbt: signature mismatch in block %d\n", i);
+			print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET, 16, 1, oob_buf, 8, 1);
+			continue;
+		}
+
+		pr_info("read_bbt: found bbt at block %d\n", i);
+		bmtd.bmt_blk_idx = i;
+		return 0;
+	}
+
+	return -EIO;
+}
+
+
+static int
+mtk_bmt_init_bbt(struct device_node *np)
+{
+	int buf_size = round_up(bmtd.total_blks >> 2, bmtd.blk_size);
+	int ret;
+
+	bmtd.bbt_buf = kmalloc(buf_size, GFP_KERNEL);
+	if (!bmtd.bbt_buf)
+		return -ENOMEM;
+
+	memset(bmtd.bbt_buf, 0xff, buf_size);
+	bmtd.mtd->size -= 4 * bmtd.mtd->erasesize;
+
+	ret = mtk_bmt_read_bbt();
+	if (ret)
+		return ret;
+
+	bmtd.bmt_pgs = buf_size / bmtd.pg_size;
+
+	return 0;
+}
+
+static int mtk_bmt_debug_bbt(void *data, u64 val)
+{
+	char buf[5];
+	int i, k;
+
+	switch (val) {
+	case 0:
+		for (i = 0; i < bmtd.total_blks; i += 4) {
+			u8 cur = bmtd.bbt_buf[i / 4];
+
+			for (k = 0; k < 4; k++, cur >>= 2)
+				buf[k] = (cur & 3) ? 'B' : '.';
+
+			buf[4] = 0;
+			printk("[%06x] %s\n", i * bmtd.blk_size, buf);
+		}
+		break;
+	case 100:
+#if 0
+		for (i = bmtd.bmt_blk_idx; i < bmtd.total_blks - 1; i++)
+			bbt_nand_erase(bmtd.bmt_blk_idx);
+#endif
+
+		bmtd.bmt_blk_idx = bmtd.total_blks - 1;
+		bbt_nand_erase(bmtd.bmt_blk_idx);
+		write_bmt(bmtd.bmt_blk_idx, bmtd.bbt_buf);
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+const struct mtk_bmt_ops mtk_bmt_bbt_ops = {
+	.sig = "mtknand",
+	.sig_len = 7,
+	.init = mtk_bmt_init_bbt,
+	.remap_block = remap_block_bbt,
+	.unmap_block = unmap_block_bbt,
+	.get_mapping_block = get_mapping_block_index_bbt,
+	.debug = mtk_bmt_debug_bbt,
+};
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_nmbm.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_nmbm.c
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt_v2.c
@ -0,0 +1,513 @@
+/*
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Xiangsheng Hou <xiangsheng.hou@mediatek.com>
+ * Copyright (c) 2020-2022 Felix Fietkau <nbd@nbd.name>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include "mtk_bmt.h"
+
+struct bbbt {
+	char signature[3];
+	/* This version is used to distinguish the legacy and new algorithm */
+#define BBMT_VERSION		2
+	unsigned char version;
+	/* Below 2 tables will be written in SLC */
+	u16 bb_tbl[];
+};
+
+struct bbmt {
+	u16 block;
+#define NO_MAPPED		0
+#define NORMAL_MAPPED	1
+#define BMT_MAPPED		2
+	u16 mapped;
+};
+
+/* Maximum 8k blocks */
+#define BBPOOL_RATIO		2
+#define BB_TABLE_MAX	bmtd.table_size
+#define BMT_TABLE_MAX	(BB_TABLE_MAX * BBPOOL_RATIO / 100)
+#define BMT_TBL_DEF_VAL	0x0
+
+static inline struct bbmt *bmt_tbl(struct bbbt *bbbt)
+{
+	return (struct bbmt *)&bbbt->bb_tbl[bmtd.table_size];
+}
+
+static u16 find_valid_block(u16 block)
+{
+	u8 fdm[4];
+	int ret;
+	int loop = 0;
+
+retry:
+	if (block >= bmtd.total_blks)
+		return 0;
+
+	ret = bbt_nand_read(blk_pg(block), bmtd.data_buf, bmtd.pg_size,
+			    fdm, sizeof(fdm));
+	/* Read the 1st byte of FDM to judge whether it's a bad
+	 * or not
+	 */
+	if (ret || fdm[0] != 0xff) {
+		pr_info("nand: found bad block 0x%x\n", block);
+		if (loop >= bmtd.bb_max) {
+			pr_info("nand: FATAL ERR: too many bad blocks!!\n");
+			return 0;
+		}
+
+		loop++;
+		block++;
+		goto retry;
+	}
+
+	return block;
+}
+
+/* Find out all bad blocks, and fill in the mapping table */
+static int scan_bad_blocks(struct bbbt *bbt)
+{
+	int i;
+	u16 block = 0;
+
+	/* First time download, the block0 MUST NOT be a bad block,
+	 * this is guaranteed by vendor
+	 */
+	bbt->bb_tbl[0] = 0;
+
+	/*
+	 * Construct the mapping table of Normal data area(non-PMT/BMTPOOL)
+	 * G - Good block; B - Bad block
+	 *			---------------------------
+	 * physical |G|G|B|G|B|B|G|G|G|G|B|G|B|
+	 *			---------------------------
+	 * What bb_tbl[i] looks like:
+	 *   physical block(i):
+	 *			 0 1 2 3 4 5 6 7 8 9 a b c
+	 *   mapped block(bb_tbl[i]):
+	 *			 0 1 3 6 7 8 9 b ......
+	 * ATTENTION:
+	 *		If new bad block ocurred(n), search bmt_tbl to find
+	 *		a available block(x), and fill in the bb_tbl[n] = x;
+	 */
+	for (i = 1; i < bmtd.pool_lba; i++) {
+		bbt->bb_tbl[i] = find_valid_block(bbt->bb_tbl[i - 1] + 1);
+		BBT_LOG("bb_tbl[0x%x] = 0x%x", i, bbt->bb_tbl[i]);
+		if (bbt->bb_tbl[i] == 0)
+			return -1;
+	}
+
+	/* Physical Block start Address of BMT pool */
+	bmtd.pool_pba = bbt->bb_tbl[i - 1] + 1;
+	if (bmtd.pool_pba >= bmtd.total_blks - 2) {
+		pr_info("nand: FATAL ERR: Too many bad blocks!!\n");
+		return -1;
+	}
+
+	BBT_LOG("pool_pba=0x%x", bmtd.pool_pba);
+	i = 0;
+	block = bmtd.pool_pba;
+	/*
+	 * The bmt table is used for runtime bad block mapping
+	 * G - Good block; B - Bad block
+	 *			---------------------------
+	 * physical |G|G|B|G|B|B|G|G|G|G|B|G|B|
+	 *			---------------------------
+	 *   block:	 0 1 2 3 4 5 6 7 8 9 a b c
+	 * What bmt_tbl[i] looks like in initial state:
+	 *   i:
+	 *			 0 1 2 3 4 5 6 7
+	 *   bmt_tbl[i].block:
+	 *			 0 1 3 6 7 8 9 b
+	 *   bmt_tbl[i].mapped:
+	 *			 N N N N N N N B
+	 *		N - Not mapped(Available)
+	 *		M - Mapped
+	 *		B - BMT
+	 * ATTENTION:
+	 *		BMT always in the last valid block in pool
+	 */
+	while ((block = find_valid_block(block)) != 0) {
+		bmt_tbl(bbt)[i].block = block;
+		bmt_tbl(bbt)[i].mapped = NO_MAPPED;
+		BBT_LOG("bmt_tbl[%d].block = 0x%x", i, block);
+		block++;
+		i++;
+	}
+
+	/* i - How many available blocks in pool, which is the length of bmt_tbl[]
+	 * bmtd.bmt_blk_idx - bmt_tbl[bmtd.bmt_blk_idx].block => the BMT block
+	 */
+	bmtd.bmt_blk_idx = i - 1;
+	bmt_tbl(bbt)[bmtd.bmt_blk_idx].mapped = BMT_MAPPED;
+
+	if (i < 1) {
+		pr_info("nand: FATAL ERR: no space to store BMT!!\n");
+		return -1;
+	}
+
+	pr_info("[BBT] %d available blocks in BMT pool\n", i);
+
+	return 0;
+}
+
+static bool is_valid_bmt(unsigned char *buf, unsigned char *fdm)
+{
+	struct bbbt *bbt = (struct bbbt *)buf;
+	u8 *sig = (u8*)bbt->signature + MAIN_SIGNATURE_OFFSET;
+
+
+	if (memcmp(bbt->signature + MAIN_SIGNATURE_OFFSET, "BMT", 3) == 0 &&
+		memcmp(fdm + OOB_SIGNATURE_OFFSET, "bmt", 3) == 0) {
+		if (bbt->version == BBMT_VERSION)
+			return true;
+	}
+	BBT_LOG("[BBT] BMT Version not match,upgrage preloader and uboot please! sig=%02x%02x%02x, fdm=%02x%02x%02x",
+		sig[0], sig[1], sig[2],
+		fdm[1], fdm[2], fdm[3]);
+	return false;
+}
+
+static u16 get_bmt_index(struct bbmt *bmt)
+{
+	int i = 0;
+
+	while (bmt[i].block != BMT_TBL_DEF_VAL) {
+		if (bmt[i].mapped == BMT_MAPPED)
+			return i;
+		i++;
+	}
+	return 0;
+}
+
+static int
+read_bmt(u16 block, unsigned char *dat, unsigned char *fdm, int fdm_len)
+{
+	u32 len = bmtd.bmt_pgs << bmtd.pg_shift;
+
+	return bbt_nand_read(blk_pg(block), dat, len, fdm, fdm_len);
+}
+
+static struct bbbt *scan_bmt(u16 block)
+{
+	u8 fdm[4];
+
+	if (block < bmtd.pool_lba)
+		return NULL;
+
+	if (read_bmt(block, bmtd.bbt_buf, fdm, sizeof(fdm)))
+		return scan_bmt(block - 1);
+
+	if (is_valid_bmt(bmtd.bbt_buf, fdm)) {
+		bmtd.bmt_blk_idx = get_bmt_index(bmt_tbl((struct bbbt *)bmtd.bbt_buf));
+		if (bmtd.bmt_blk_idx == 0) {
+			pr_info("[BBT] FATAL ERR: bmt block index is wrong!\n");
+			return NULL;
+		}
+		pr_info("[BBT] BMT.v2 is found at 0x%x\n", block);
+		return (struct bbbt *)bmtd.bbt_buf;
+	} else
+		return scan_bmt(block - 1);
+}
+
+/* Write the Burner Bad Block Table to Nand Flash
+ * n - write BMT to bmt_tbl[n]
+ */
+static u16 upload_bmt(struct bbbt *bbt, int n)
+{
+	u16 block;
+
+retry:
+	if (n < 0 || bmt_tbl(bbt)[n].mapped == NORMAL_MAPPED) {
+		pr_info("nand: FATAL ERR: no space to store BMT!\n");
+		return (u16)-1;
+	}
+
+	block = bmt_tbl(bbt)[n].block;
+	BBT_LOG("n = 0x%x, block = 0x%x", n, block);
+	if (bbt_nand_erase(block)) {
+		bmt_tbl(bbt)[n].block = 0;
+		/* erase failed, try the previous block: bmt_tbl[n - 1].block */
+		n--;
+		goto retry;
+	}
+
+	/* The signature offset is fixed set to 0,
+	 * oob signature offset is fixed set to 1
+	 */
+	memcpy(bbt->signature + MAIN_SIGNATURE_OFFSET, "BMT", 3);
+	bbt->version = BBMT_VERSION;
+
+	if (write_bmt(block, (unsigned char *)bbt)) {
+		bmt_tbl(bbt)[n].block = 0;
+
+		/* write failed, try the previous block in bmt_tbl[n - 1] */
+		n--;
+		goto retry;
+	}
+
+	/* Return the current index(n) of BMT pool (bmt_tbl[n]) */
+	return n;
+}
+
+static u16 find_valid_block_in_pool(struct bbbt *bbt)
+{
+	int i;
+
+	if (bmtd.bmt_blk_idx == 0)
+		goto error;
+
+	for (i = 0; i < bmtd.bmt_blk_idx; i++) {
+		if (bmt_tbl(bbt)[i].block != 0 && bmt_tbl(bbt)[i].mapped == NO_MAPPED) {
+			bmt_tbl(bbt)[i].mapped = NORMAL_MAPPED;
+			return bmt_tbl(bbt)[i].block;
+		}
+	}
+
+error:
+	pr_info("nand: FATAL ERR: BMT pool is run out!\n");
+	return 0;
+}
+
+/* We met a bad block, mark it as bad and map it to a valid block in pool,
+ * if it's a write failure, we need to write the data to mapped block
+ */
+static bool remap_block_v2(u16 block, u16 mapped_block, int copy_len)
+{
+	u16 new_block;
+	struct bbbt *bbt;
+
+	bbt = bmtd.bbt;
+	new_block = find_valid_block_in_pool(bbt);
+	if (new_block == 0)
+		return false;
+
+	/* Map new bad block to available block in pool */
+	bbt->bb_tbl[block] = new_block;
+
+	/* Erase new block */
+	bbt_nand_erase(new_block);
+	if (copy_len > 0)
+		bbt_nand_copy(new_block, mapped_block, copy_len);
+
+	bmtd.bmt_blk_idx = upload_bmt(bbt, bmtd.bmt_blk_idx);
+
+	return true;
+}
+
+static int get_mapping_block_index_v2(int block)
+{
+	int start, end;
+
+	if (block >= bmtd.pool_lba)
+		return block;
+
+	if (!mapping_block_in_range(block, &start, &end))
+		return block;
+
+	return bmtd.bbt->bb_tbl[block];
+}
+
+static void
+unmap_block_v2(u16 block)
+{
+	bmtd.bbt->bb_tbl[block] = block;
+	bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+}
+
+static unsigned long *
+mtk_bmt_get_mapping_mask(void)
+{
+	struct bbmt *bbmt = bmt_tbl(bmtd.bbt);
+	int main_blocks = bmtd.mtd->size >> bmtd.blk_shift;
+	unsigned long *used;
+	int i, k;
+
+	used = kcalloc(sizeof(unsigned long), BIT_WORD(bmtd.bmt_blk_idx) + 1, GFP_KERNEL);
+	if (!used)
+		return NULL;
+
+	for (i = 1; i < main_blocks; i++) {
+		if (bmtd.bbt->bb_tbl[i] == i)
+			continue;
+
+		for (k = 0; k < bmtd.bmt_blk_idx; k++) {
+			if (bmtd.bbt->bb_tbl[i] != bbmt[k].block)
+				continue;
+
+			set_bit(k, used);
+			break;
+		}
+	}
+
+	return used;
+}
+
+static int mtk_bmt_debug_v2(void *data, u64 val)
+{
+	struct bbmt *bbmt = bmt_tbl(bmtd.bbt);
+	struct mtd_info *mtd = bmtd.mtd;
+	unsigned long *used;
+	int main_blocks = mtd->size >> bmtd.blk_shift;
+	int n_remap = 0;
+	int i;
+
+	used = mtk_bmt_get_mapping_mask();
+	if (!used)
+		return -ENOMEM;
+
+	switch (val) {
+	case 0:
+		for (i = 1; i < main_blocks; i++) {
+			if (bmtd.bbt->bb_tbl[i] == i)
+				continue;
+
+			printk("remap [%x->%x]\n", i, bmtd.bbt->bb_tbl[i]);
+			n_remap++;
+		}
+		for (i = 0; i <= bmtd.bmt_blk_idx; i++) {
+			char c;
+
+			switch (bbmt[i].mapped) {
+			case NO_MAPPED:
+				continue;
+			case NORMAL_MAPPED:
+				c = 'm';
+				if (test_bit(i, used))
+					c = 'M';
+				break;
+			case BMT_MAPPED:
+				c = 'B';
+				break;
+			default:
+				c = 'X';
+				break;
+			}
+			printk("[%x:%c] = 0x%x\n", i, c, bbmt[i].block);
+		}
+		break;
+	case 100:
+		for (i = 0; i <= bmtd.bmt_blk_idx; i++) {
+			if (bbmt[i].mapped != NORMAL_MAPPED)
+				continue;
+
+			if (test_bit(i, used))
+				continue;
+
+			n_remap++;
+			bbmt[i].mapped = NO_MAPPED;
+			printk("free block [%d:%x]\n", i, bbmt[i].block);
+		}
+		if (n_remap)
+			bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+		break;
+	}
+
+	kfree(used);
+
+	return 0;
+}
+
+static int mtk_bmt_init_v2(struct device_node *np)
+{
+	u32 bmt_pool_size, bmt_table_size;
+	u32 bufsz, block;
+	u16 pmt_block;
+
+	if (of_property_read_u32(np, "mediatek,bmt-pool-size",
+				 &bmt_pool_size) != 0)
+		bmt_pool_size = 80;
+
+	if (of_property_read_u8(np, "mediatek,bmt-oob-offset",
+				 &bmtd.oob_offset) != 0)
+		bmtd.oob_offset = 0;
+
+	if (of_property_read_u32(np, "mediatek,bmt-table-size",
+				 &bmt_table_size) != 0)
+		bmt_table_size = 0x2000U;
+
+	bmtd.table_size = bmt_table_size;
+
+	pmt_block = bmtd.total_blks - bmt_pool_size - 2;
+
+	bmtd.mtd->size = pmt_block << bmtd.blk_shift;
+
+	/*
+	 *  ---------------------------------------
+	 * | PMT(2blks) | BMT POOL(totalblks * 2%) |
+	 *  ---------------------------------------
+	 * ^            ^
+	 * |            |
+	 * pmt_block	pmt_block + 2blocks(pool_lba)
+	 *
+	 * ATTETION!!!!!!
+	 *     The blocks ahead of the boundary block are stored in bb_tbl
+	 *     and blocks behind are stored in bmt_tbl
+	 */
+
+	bmtd.pool_lba = (u16)(pmt_block + 2);
+	bmtd.bb_max = bmtd.total_blks * BBPOOL_RATIO / 100;
+
+	bufsz = round_up(sizeof(struct bbbt) +
+			 bmt_table_size * sizeof(struct bbmt), bmtd.pg_size);
+	bmtd.bmt_pgs = bufsz >> bmtd.pg_shift;
+
+	bmtd.bbt_buf = kzalloc(bufsz, GFP_KERNEL);
+	if (!bmtd.bbt_buf)
+		return -ENOMEM;
+
+	memset(bmtd.bbt_buf, 0xff, bufsz);
+
+	/* Scanning start from the first page of the last block
+	 * of whole flash
+	 */
+	bmtd.bbt = scan_bmt(bmtd.total_blks - 1);
+	if (!bmtd.bbt) {
+		/* BMT not found */
+		if (bmtd.total_blks > BB_TABLE_MAX + BMT_TABLE_MAX) {
+			pr_info("nand: FATAL: Too many blocks, can not support!\n");
+			return -1;
+		}
+
+		bmtd.bbt = (struct bbbt *)bmtd.bbt_buf;
+		memset(bmt_tbl(bmtd.bbt), BMT_TBL_DEF_VAL,
+		       bmtd.table_size * sizeof(struct bbmt));
+
+		if (scan_bad_blocks(bmtd.bbt))
+			return -1;
+
+		/* BMT always in the last valid block in pool */
+		bmtd.bmt_blk_idx = upload_bmt(bmtd.bbt, bmtd.bmt_blk_idx);
+		block = bmt_tbl(bmtd.bbt)[bmtd.bmt_blk_idx].block;
+		pr_notice("[BBT] BMT.v2 is written into PBA:0x%x\n", block);
+
+		if (bmtd.bmt_blk_idx == 0)
+			pr_info("nand: Warning: no available block in BMT pool!\n");
+		else if (bmtd.bmt_blk_idx == (u16)-1)
+			return -1;
+	}
+
+	return 0;
+}
+
+
+const struct mtk_bmt_ops mtk_bmt_v2_ops = {
+	.sig = "bmt",
+	.sig_len = 3,
+	.init = mtk_bmt_init_v2,
+	.remap_block = remap_block_v2,
+	.unmap_block = unmap_block_v2,
+	.get_mapping_block = get_mapping_block_index_v2,
+	.debug = mtk_bmt_debug_v2,
+};
--- a/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch
+++ b/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch
@ -156,7 +156,7 @@
 	.name		= "mtdblock",
 	.major		= MTD_BLOCK_MAJOR,
 +#ifdef CONFIG_FIT_PARTITION
-+	.part_bits	= 1,
+	.part_bits	= 2,
 +#else
 	.part_bits	= 0,
 +#endif
--- a/target/linux/generic/hack-5.10/430-mtk-bmt-support.patch
+++ b/target/linux/generic/hack-5.10/430-mtk-bmt-support.patch
@ -17,7 +17,7 @@
 
 nandcore-objs := core.o bbt.o
 obj-$(CONFIG_MTD_NAND_CORE) += nandcore.o
-+obj-$(CONFIG_MTD_NAND_MTK_BMT)	+= mtk_bmt.o
+obj-$(CONFIG_MTD_NAND_MTK_BMT)	+= mtk_bmt.o mtk_bmt_v2.o mtk_bmt_bbt.o mtk_bmt_nmbm.o
 
 obj-y	+= onenand/
 obj-y	+= raw/
--- a/target/linux/generic/pending-5.10/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
+++ b/target/linux/generic/pending-5.10/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 21 Mar 2022 20:39:59 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: enable threaded NAPI
+
+This can improve performance under load by ensuring that NAPI processing is
+not pinned on CPU 0.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2171,8 +2171,8 @@ static irqreturn_t mtk_handle_irq_rx(int
+ 
+ 	eth->rx_events++;
+ 	if (likely(napi_schedule_prep(&eth->rx_napi))) {
+-		__napi_schedule(&eth->rx_napi);
+ 		mtk_rx_irq_disable(eth, MTK_RX_DONE_INT);
+		__napi_schedule(&eth->rx_napi);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -2184,8 +2184,8 @@ static irqreturn_t mtk_handle_irq_tx(int
+ 
+ 	eth->tx_events++;
+ 	if (likely(napi_schedule_prep(&eth->tx_napi))) {
+-		__napi_schedule(&eth->tx_napi);
+ 		mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
+		__napi_schedule(&eth->tx_napi);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -3229,6 +3229,8 @@ static int mtk_probe(struct platform_dev
+ 	 * for NAPI to work
+ 	 */
+ 	init_dummy_netdev(&eth->dummy_dev);
+	eth->dummy_dev.threaded = 1;
+	strcpy(eth->dummy_dev.name, "mtk_eth");
+ 	netif_napi_add(&eth->dummy_dev, &eth->tx_napi, mtk_napi_tx,
+ 		       MTK_NAPI_WEIGHT);
+ 	netif_napi_add(&eth->dummy_dev, &eth->rx_napi, mtk_napi_rx,
--- a/target/linux/ipq40xx/Makefile
+++ b/target/linux/ipq40xx/Makefile
@ -6,7 +6,7 @@ BOARDNAME:=Qualcomm Atheros IPQ40XX
 FEATURES:=squashfs fpu ramdisk nand
 CPU_TYPE:=cortex-a7
 CPU_SUBTYPE:=neon-vfpv4
-SUBTARGETS:=generic mikrotik
+SUBTARGETS:=generic chromium mikrotik

 KERNEL_PATCHVER:=5.10
 KERNEL_TESTING_PATCHVER:=5.10
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@ -46,6 +46,7 @@ ipq40xx_setup_interfaces()
 	cilab,meshpoint-one|\
 	edgecore,ecw5211|\
 	edgecore,oap100|\
+	google,wifi|\
 	openmesh,a42|\
 	openmesh,a62)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
--- a/target/linux/ipq40xx/base-files/etc/uci-defaults/04_led_migration
+++ b/target/linux/ipq40xx/base-files/etc/uci-defaults/04_led_migration
@ -10,6 +10,9 @@ engenius,ens620ext|\
 zyxel,nbg6617)
 	migrate_leds ":wlan2G=:wlan2g" ":wlan5G=:wlan5g"
 	;;
+netgear,wac510)
+	migrate_leds ":wlan2g=:wlan-0" ":wlan5g=:wlan-1" ":act=:activity"
+	;;
 esac

 remove_devicename_leds
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@ -154,6 +154,13 @@ platform_do_upgrade() {
 	p2w,r619ac-128m)
 		nand_do_upgrade "$1"
 		;;
+	google,wifi)
+		export_bootdevice
+		export_partdevice CI_ROOTDEV 0
+		CI_KERNPART="kernel"
+		CI_ROOTPART="rootfs"
+		emmc_do_upgrade "$1"
+		;;
 	linksys,ea6350v3 |\
 	linksys,ea8300 |\
 	linksys,mr8300)
@ -202,7 +209,8 @@ platform_do_upgrade() {

 platform_copy_config() {
 	case "$(board_name)" in
-	glinet,gl-b2200)
+	glinet,gl-b2200 |\
+	google,wifi)
 		emmc_copy_config
 		;;
 	esac
--- a/target/linux/ipq40xx/chromium/config-default
+++ b/target/linux/ipq40xx/chromium/config-default
@ -0,0 +1,10 @@
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_SCSI_REQUEST=y
+CONFIG_SCSI=y
+CONFIG_SG_POOL=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_HOST=y
+CONFIG_USB_DWC3_QCOM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
--- a/target/linux/ipq40xx/chromium/target.mk
+++ b/target/linux/ipq40xx/chromium/target.mk
@ -0,0 +1,2 @@
+BOARDNAME:=Google Chromium
+FEATURES += emmc boot-part rootfs-part
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-wac510.dts
@ -5,6 +5,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/soc/qcom,tcsr.h>
+#include <dt-bindings/leds/common.h>

 / {
 	model = "Netgear WAC510";
@ -42,14 +43,6 @@
 			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
 		};

-		tcsr@194b000 {
-			status = "okay";
-
-			compatible = "qcom,tcsr";
-			reg = <0x194b000 0x100>;
-			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
-		};
-
 		ess_tcsr@1953000 {
 			compatible = "qcom,tcsr";
 			reg = <0x1953000 0x1000>;
@ -62,14 +55,6 @@
 			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
 		};

-		usb2: usb2@60f8800 {
-			status = "okay";
-		};
-
-		usb3: usb3@8af8800 {
-			status = "okay";
-		};
-
 		crypto@8e3a000 {
 			status = "okay";
 		};
@ -119,43 +104,60 @@
 	leds {
 		compatible = "gpio-leds";

-		led_power_amber: power_amber {
+		led_power_amber: led-0 {
 			label = "amber:power";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
 			gpios = <&ssr 6 GPIO_ACTIVE_LOW>;
 			panic-indicator;
 		};

-		led_power_green: power_green {
+		led_power_green: led-1 {
 			label = "green:power";
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_POWER;
 			gpios = <&ssr 5 GPIO_ACTIVE_LOW>;
 		};

-		wlan2g_blue {
-			label = "blue:wlan2g";
+		led-2 {
+			/* 2.4GHz blue - activity */
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <0>;
 			gpios = <&ssr 4 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy0tpt";
 		};

-		wlan2g_green {
-			label = "green:wlan2g";
+		led-3 {
+			/* 2.4GHz green - link */
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <0>;
 			gpios = <&ssr 3 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy0radio";
 		};

-		wlan5g_blue {
-			label = "blue:wlan5g";
+		led-4 {
+			/* 5GHz blue - activity */
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <1>;
 			gpios = <&ssr 2 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy1tpt";
 		};

-		wlan5g_green {
-			label = "green:wlan5g";
+		led-5 {
+			/* 5GHz green - link */
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <1>;
 			gpios = <&ssr 1 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy1radio";
 		};

-		act_green {
-			label = "green:act";
+		led-6 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_ACTIVITY;
 			gpios = <&ssr 0 GPIO_ACTIVE_LOW>;
 		};
 	};
@ -378,15 +380,3 @@
 	mac-address-increment = <16>;
 	qcom,ath10k-calibration-variant = "Netgear-WAC510";
 };
-
-&usb3_ss_phy {
-	status = "okay";
-};
-
-&usb3_hs_phy {
-	status = "okay";
-};
-
-&usb2_hs_phy {
-	status = "okay";
-};
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c1.dts
@ -89,3 +89,16 @@
 	};
 };

+&wifi0 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
+	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C1";
+};
+
+&wifi1 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
+	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C1";
+};
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac-c2.dts
@ -124,3 +124,16 @@
 	};
 };

+&wifi0 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
+	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C2";
+};
+
+&wifi1 {
+	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
+	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC-C2";
+};
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-e2600ac.dtsi
@ -254,17 +254,3 @@
 &usb2_hs_phy {
 	status = "okay";
 };
-
-&wifi0 {
-	status = "okay";
-	nvmem-cell-names = "pre-calibration";
-	nvmem-cells = <&precal_art_1000>;
-	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC";
-};
-
-&wifi1 {
-	status = "okay";
-	nvmem-cell-names = "pre-calibration";
-	nvmem-cells = <&precal_art_5000>;
-	qcom,ath10k-calibration-variant = "Qxwlan-E2600AC";
-};
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-wifi.dts
@ -0,0 +1,413 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2016, 2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016 Google, Inc
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Google WiFi (Gale)";
+	compatible = "google,wifi", "google,gale-v2", "qcom,ipq4019";
+
+	chosen {
+		/*
+		 * rootwait: in case we're booting from slow/async USB storage.
+		 */
+		bootargs-append = " rootwait";
+		stdout-path = &blsp1_uart1;
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x20000000>; /* 512MB */
+	};
+
+	soc {
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+	};
+};
+
+&tlmm {
+	fw_pinmux {
+		wp {
+			pins = "gpio53";
+			output-low;
+		};
+		recovery {
+			pins = "gpio57";
+			bias-none;
+		};
+		developer {
+			pins = "gpio41";
+			bias-none;
+		};
+	};
+
+	reset802_15_4 {
+		pins = "gpio60";
+	};
+
+	led_reset {
+		pins = "gpio22";
+		output-high;
+	};
+
+	sys_reset {
+		pins = "gpio19";
+		output-high;
+	};
+
+	rx_active {
+		pins = "gpio43";
+		bias-pull,down;
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14","gpio15";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio12";
+		};
+		pinconf {
+			pins = "gpio13", "gpio14","gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi_1_pins: spi_1_pinmux {
+		pinmux {
+			function = "blsp_spi1";
+			pins = "gpio44", "gpio46","gpio47";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio45";
+		};
+		pinconf {
+			pins = "gpio44", "gpio46","gpio47";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio45";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	serial_0_pins: serial0_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	serial_1_pins: serial1_pinmux {
+		mux {
+			pins = "gpio8", "gpio9", "gpio10", "gpio11";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	i2c_0_pins: i2c_0_pinmux {
+		mux {
+			pins = "gpio20", "gpio21";
+			function = "blsp_i2c0";
+			drive-open-drain;
+		};
+	};
+
+	i2c_1_pins: i2c_1_pinmux {
+		mux {
+			pins = "gpio34", "gpio35";
+			function = "blsp_i2c1";
+			drive-open-drain;
+		};
+	};
+
+	sd_0_pins: sd_0_pinmux {
+		sd0 {
+			pins = "gpio23", "gpio24", "gpio25", "gpio26", "gpio29", "gpio30", "gpio31", "gpio32";
+			function = "sdio";
+			drive-strength = <10>;
+			bias-pull-up;
+			pull-up-res = <0>;
+		};
+		sdclk {
+			pins = "gpio27";
+			function = "sdio";
+			drive-strength = <2>;
+			bias-pull-up;
+			pull-up-res = <0>;
+		};
+		sdcmd {
+			pins = "gpio28";
+			function = "sdio";
+			drive-strength = <10>;
+			bias-pull-up;
+			pull-up-res = <0>;
+		};
+	};
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-disable;
+		};
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-disable;
+		};
+		mux_3 {
+			pins = "gpio40";
+			function = "gpio";
+			bias-disable;
+			output-high;
+		};
+	};
+
+	wifi1_1_pins: wifi2_pinmux {
+		mux {
+			pins = "gpio58";
+			output-low;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_i2c3 {
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	tpm@20 {
+		compatible = "infineon,slb9645tt";
+		reg = <0x20>;
+		powered-while-suspended;
+	};
+};
+
+&blsp1_i2c4 {
+	pinctrl-0 = <&i2c_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	led-controller@32 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+
+#if 1
+		led@0 {
+			reg = <0>;
+			chan-name = "LED0_Red";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led@1 {
+			reg = <1>;
+			chan-name = "LED0_Green";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led@2 {
+			reg = <2>;
+			chan-name = "LED0_Blue";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+#else
+		/*
+		 * openwrt isn't ready to handle multi-intensity leds yet
+		 * # echo 255 255 255 > /sys/class/leds/tricolor/multi_intensity
+		 * # echo 255 > /sys/class/leds/tricolor/brightness
+		 */
+		multi-led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_RGB>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				chan-name = "tricolor";
+				led-cur = /bits/ 8 <0x64>;
+				max-cur = /bits/ 8 <0x78>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			led@1 {
+				reg = <1>;
+				chan-name = "tricolor";
+				led-cur = /bits/ 8 <0x64>;
+				max-cur = /bits/ 8 <0x78>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				chan-name = "tricolor";
+				led-cur = /bits/ 8 <0x64>;
+				max-cur = /bits/ 8 <0x78>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+#endif
+	};
+};
+
+&blsp1_spi1 {
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+	};
+};
+
+&blsp1_spi2 {
+	pinctrl-0 = <&spi_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 45 GPIO_ACTIVE_HIGH>;
+
+	/*
+	 * This "spidev" was included in the manufacturer device tree. I
+	 * suspect it's the (unused; and removed from later HW spins) Zigbee
+	 * radio -- SiliconLabs EM3581 Zigbee? There's no driver or binding for
+	 * this at the moment.
+	 */
+	spidev@0 {
+		compatible = "spidev";
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	pinctrl-0 = <&serial_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&gmac0 {
+	qcom,phy_mdio_addr = <4>;
+	qcom,poll_required = <1>;
+	qcom,forced_speed = <1000>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <2 0x20>;
+};
+
+&gmac1 {
+	qcom,phy_mdio_addr = <3>;
+	qcom,forced_duplex = <1>;
+	vlan_tag = <1 0x10>;
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+};
+
+&prng {
+	status = "okay";
+};
+
+&sdhci {
+	status = "okay";
+	pinctrl-0 = <&sd_0_pins>;
+	pinctrl-names = "default";
+	clock-frequency = <192000000>;
+	vqmmc-supply = <&vqmmc>;
+	non-removable;
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&vqmmc {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "GO_GALE";
+};
+
+&wifi1 {
+	status = "okay";
+	pinctrl-0 = <&wifi1_1_pins>;
+	pinctrl-names = "default";
+	qcom,ath10k-calibration-variant = "GO_GALE";
+};
--- a/target/linux/ipq40xx/image/chromium.mk
+++ b/target/linux/ipq40xx/image/chromium.mk
@ -0,0 +1,36 @@
+define Build/cros-gpt
+	cp $@ $@.tmp 2>/dev/null || true
+	ptgen -o $@.tmp -g \
+		-T cros_kernel	-N kernel -p $(CONFIG_TARGET_KERNEL_PARTSIZE)m \
+				-N rootfs -p $(CONFIG_TARGET_ROOTFS_PARTSIZE)m
+	cat $@.tmp >> $@
+	rm $@.tmp
+endef
+
+define Build/append-kernel-part
+	dd if=$(IMAGE_KERNEL) bs=$(CONFIG_TARGET_KERNEL_PARTSIZE)M conv=sync >> $@
+endef
+
+# NB: Chrome OS bootloaders replace the '%U' in command lines with the UUID of
+# the kernel partition it chooses to boot from. This gives a flexible way to
+# consistently build and sign kernels that always use the subsequent
+# (PARTNROFF=1) partition as their rootfs.
+define Build/cros-vboot
+	$(STAGING_DIR_HOST)/bin/cros-vbutil \
+		-k $@ -c "root=PARTUUID=%U/PARTNROFF=1" -o $@.new
+	@mv $@.new $@
+endef
+
+define Device/google_wifi
+	DEVICE_VENDOR := Google
+	DEVICE_MODEL := WiFi (Gale)
+	SOC := qcom-ipq4019
+	KERNEL_SUFFIX := -fit-zImage.itb.vboot
+	KERNEL = kernel-bin | fit none $$(DTS_DIR)/$$(DEVICE_DTS).dtb | cros-vboot
+	KERNEL_NAME := zImage
+	IMAGES += factory.bin
+	IMAGE/factory.bin := cros-gpt | append-kernel-part | append-rootfs
+	DEVICE_PACKAGES := ipq-wifi-google_wifi partx-utils mkf2fs e2fsprogs \
+			   kmod-fs-ext4 kmod-fs-f2fs kmod-google-firmware
+endef
+TARGET_DEVICES += google_wifi
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@ -269,6 +269,8 @@ define Device/avm_fritzbox-7530
 	$(call Device/FitImageLzma)
 	DEVICE_VENDOR := AVM
 	DEVICE_MODEL := FRITZ!Box 7530
+	DEVICE_ALT0_VENDOR := AVM
+	DEVICE_ALT0_MODEL := FRITZ!Box 7520
 	SOC := qcom-ipq4019
 	DEVICE_PACKAGES := fritz-caldata fritz-tffs-nand
 endef
@ -928,7 +930,7 @@ define Device/qxwlan_e2600ac-c1
 	KERNEL_SIZE := 4096k
 	IMAGE_SIZE := 31232k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
-	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac
+	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac-c1
 	DEFAULT := n
 endef
 TARGET_DEVICES += qxwlan_e2600ac-c1
@ -943,7 +945,7 @@ define Device/qxwlan_e2600ac-c2
 	KERNEL_INSTALL := 1
 	BLOCKSIZE := 128k
 	PAGESIZE := 2048
-	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac
+	DEVICE_PACKAGES := ipq-wifi-qxwlan_e2600ac-c2
 endef
 TARGET_DEVICES += qxwlan_e2600ac-c2

@ -972,6 +974,7 @@ define Device/tel_x1pro
 	IMAGE_SIZE := 31232k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 	DEVICE_PACKAGES := kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
+	DEFAULT := n
 endef
 TARGET_DEVICES += tel_x1pro

--- a/target/linux/ipq40xx/patches-5.10/420-firmware-qcom-scm-disable-SDI.patch
+++ b/target/linux/ipq40xx/patches-5.10/420-firmware-qcom-scm-disable-SDI.patch
@ -0,0 +1,47 @@
+--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
+@@ -404,6 +404,20 @@ static int __qcom_scm_set_dload_mode(str
+ 	return qcom_scm_call_atomic(__scm->dev, &desc, NULL);
+ }
+ 
+static int __qcom_scm_disable_sdi(struct device *dev)
+{
+	struct qcom_scm_desc desc = {
+		.svc = QCOM_SCM_SVC_BOOT,
+		.cmd = QCOM_SCM_BOOT_CONFIG_SDI,
+		.arginfo = QCOM_SCM_ARGS(2),
+		.args[0] = 1  /* 1: disable watchdog debug */,
+		.args[1] = 0  /* 0: disable SDI */,
+		.owner = ARM_SMCCC_OWNER_SIP,
+	};
+
+	return qcom_scm_call(__scm->dev, &desc, NULL);
+}
+
+ static void qcom_scm_set_download_mode(bool enable)
+ {
+ 	bool avail;
+@@ -1256,6 +1270,13 @@ static int qcom_scm_probe(struct platfor
+ 	if (download_mode)
+ 		qcom_scm_set_download_mode(true);
+ 
+	/*
+	 * Factory firmware leaves SDI (a debug interface), which prevents
+	 * clean reboot.
+	 */
+	if (of_machine_is_compatible("google,wifi"))
+		__qcom_scm_disable_sdi(__scm->dev);
+
+ 	return 0;
+ }
+ 
+--- a/drivers/firmware/qcom_scm.h
+++ b/drivers/firmware/qcom_scm.h
+@@ -77,6 +77,7 @@ extern int scm_legacy_call(struct device
+ #define QCOM_SCM_SVC_BOOT		0x01
+ #define QCOM_SCM_BOOT_SET_ADDR		0x01
+ #define QCOM_SCM_BOOT_TERMINATE_PC	0x02
+#define QCOM_SCM_BOOT_CONFIG_SDI	0x09
+ #define QCOM_SCM_BOOT_SET_DLOAD_MODE	0x10
+ #define QCOM_SCM_BOOT_SET_REMOTE_STATE	0x0a
+ #define QCOM_SCM_FLUSH_FLAG_MASK	0x3
--- a/target/linux/ipq40xx/patches-5.10/421-firmware-qcom-scm-cold-boot-address.patch
+++ b/target/linux/ipq40xx/patches-5.10/421-firmware-qcom-scm-cold-boot-address.patch
@ -0,0 +1,121 @@
+--- a/drivers/firmware/qcom_scm-legacy.c
+++ b/drivers/firmware/qcom_scm-legacy.c
+@@ -13,6 +13,9 @@
+ #include <linux/arm-smccc.h>
+ #include <linux/dma-mapping.h>
+ 
+#include <asm/cacheflush.h>
+#include <asm/outercache.h>
+
+ #include "qcom_scm.h"
+ 
+ static DEFINE_MUTEX(qcom_scm_lock);
+@@ -117,6 +120,25 @@ static void __scm_legacy_do(const struct
+ 	} while (res->a0 == QCOM_SCM_INTERRUPTED);
+ }
+ 
+static void qcom_scm_inv_range(unsigned long start, unsigned long end)
+{
+	u32 cacheline_size, ctr;
+
+	asm volatile("mrc p15, 0, %0, c0, c0, 1" : "=r" (ctr));
+	cacheline_size = 4 << ((ctr >> 16) & 0xf);
+
+	start = round_down(start, cacheline_size);
+	end = round_up(end, cacheline_size);
+	outer_inv_range(start, end);
+	while (start < end) {
+		asm ("mcr p15, 0, %0, c7, c6, 1" : : "r" (start)
+		     : "memory");
+		start += cacheline_size;
+	}
+	dsb();
+	isb();
+}
+
+ /**
+  * qcom_scm_call() - Sends a command to the SCM and waits for the command to
+  * finish processing.
+@@ -160,10 +182,16 @@ int scm_legacy_call(struct device *dev,
+ 
+ 	rsp = scm_legacy_command_to_response(cmd);
+ 
+-	cmd_phys = dma_map_single(dev, cmd, alloc_len, DMA_TO_DEVICE);
+-	if (dma_mapping_error(dev, cmd_phys)) {
+-		kfree(cmd);
+-		return -ENOMEM;
+	if (dev) {
+		cmd_phys = dma_map_single(dev, cmd, alloc_len, DMA_TO_DEVICE);
+		if (dma_mapping_error(dev, cmd_phys)) {
+			kfree(cmd);
+			return -ENOMEM;
+		}
+	} else {
+		cmd_phys = virt_to_phys(cmd);
+		__cpuc_flush_dcache_area(cmd, alloc_len);
+		outer_flush_range(cmd_phys, cmd_phys + alloc_len);
+ 	}
+ 
+ 	smc.args[0] = 1;
+@@ -179,13 +207,26 @@ int scm_legacy_call(struct device *dev,
+ 		goto out;
+ 
+ 	do {
+-		dma_sync_single_for_cpu(dev, cmd_phys + sizeof(*cmd) + cmd_len,
+-					sizeof(*rsp), DMA_FROM_DEVICE);
+		if (dev) {
+			dma_sync_single_for_cpu(dev, cmd_phys + sizeof(*cmd) +
+						cmd_len, sizeof(*rsp),
+						DMA_FROM_DEVICE);
+		} else {
+			unsigned long start = (uintptr_t)cmd + sizeof(*cmd) +
+					      cmd_len;
+			qcom_scm_inv_range(start, start + sizeof(*rsp));
+		}
+ 	} while (!rsp->is_complete);
+ 
+-	dma_sync_single_for_cpu(dev, cmd_phys + sizeof(*cmd) + cmd_len +
+-				le32_to_cpu(rsp->buf_offset),
+-				resp_len, DMA_FROM_DEVICE);
+	if (dev) {
+		dma_sync_single_for_cpu(dev, cmd_phys + sizeof(*cmd) + cmd_len +
+					le32_to_cpu(rsp->buf_offset),
+					resp_len, DMA_FROM_DEVICE);
+	} else {
+		unsigned long start = (uintptr_t)cmd + sizeof(*cmd) + cmd_len +
+				      le32_to_cpu(rsp->buf_offset);
+		qcom_scm_inv_range(start, start + resp_len);
+	}
+ 
+ 	if (res) {
+ 		res_buf = scm_legacy_get_response_buffer(rsp);
+@@ -193,7 +234,8 @@ int scm_legacy_call(struct device *dev,
+ 			res->result[i] = le32_to_cpu(res_buf[i]);
+ 	}
+ out:
+-	dma_unmap_single(dev, cmd_phys, alloc_len, DMA_TO_DEVICE);
+	if (dev)
+		dma_unmap_single(dev, cmd_phys, alloc_len, DMA_TO_DEVICE);
+ 	kfree(cmd);
+ 	return ret;
+ }
+--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
+@@ -344,6 +344,17 @@ int qcom_scm_set_cold_boot_addr(void *en
+ 	desc.args[0] = flags;
+ 	desc.args[1] = virt_to_phys(entry);
+ 
+	/*
+	 * Factory firmware doesn't support the atomic variant. Non-atomic SCMs
+	 * require ugly DMA invalidation support that was dropped upstream a
+	 * while ago. For more info, see:
+	 *
+	 *  [RFC] qcom_scm: IPQ4019 firmware does not support atomic API?
+	 *  https://lore.kernel.org/linux-arm-msm/20200913201608.GA3162100@bDebian/
+	 */
+	if (of_machine_is_compatible("google,wifi"))
+		return qcom_scm_call(__scm ? __scm->dev : NULL, &desc, NULL);
+
+ 	return qcom_scm_call_atomic(__scm ? __scm->dev : NULL, &desc, NULL);
+ }
+ EXPORT_SYMBOL(qcom_scm_set_cold_boot_addr);
--- a/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch
+++ b/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch
@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>

 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -903,11 +903,75 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+@@ -903,11 +903,76 @@ dtb-$(CONFIG_ARCH_QCOM) += \
 	qcom-apq8074-dragonboard.dtb \
 	qcom-apq8084-ifc6540.dtb \
 	qcom-apq8084-mtp.dtb \
@ -71,10 +71,11 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +	qcom-ipq4019-rtl30vw.dtb \
 +	qcom-ipq4019-srr60.dtb \
 +	qcom-ipq4019-srs60.dtb \
-+	qcom-ipq4019-x1pro.dtb \
 +	qcom-ipq4019-u4019-32m.dtb \
+	qcom-ipq4019-wifi.dtb \
 +	qcom-ipq4019-wpj419.dtb \
 +	qcom-ipq4019-wtr-m2133hp.dtb \
+	qcom-ipq4019-x1pro.dtb \
 +	qcom-ipq4028-wpj428.dtb \
 +	qcom-ipq4029-ap-303.dtb \
 +	qcom-ipq4029-ap-303h.dtb \
--- a/target/linux/lantiq/patches-5.10/0703-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
+++ b/target/linux/lantiq/patches-5.10/0703-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
@ -1,101 +0,0 @@
-From 24a43ae2ac0ea06c474b1c80dc75651294d49321 Mon Sep 17 00:00:00 2001
-From: Thomas Nixon <tom@tomn.co.uk>
-Date: Sat, 2 Oct 2021 00:48:05 +0100
-Subject: [PATCH 2/2] net: lantiq: enable jumbo frames on GSWIP
-
-This enables non-standard MTUs on a per-port basis, with the overall
-frame size set based on the CPU port.
-
-When the MTU is not changed, this should have no effect.
-
-Long packets crash the switch with MTUs of greater than 2526, so the
-maximum is limited for now.
-
-Signed-off-by: Thomas Nixon <tom@tomn.co.uk>
---
- drivers/net/dsa/lantiq_gswip.c | 46 +++++++++++++++++++++++++++++++---
- 1 file changed, 42 insertions(+), 4 deletions(-)
-
--- a/drivers/net/dsa/lantiq_gswip.c
-+++ b/drivers/net/dsa/lantiq_gswip.c
-@@ -238,6 +238,11 @@
- 
- #define XRX200_GPHY_FW_ALIGN	(16 * 1024)
- 
-+/* maximum packet size supported by the switch; in theory this should be 9600,
-+ * but long packets currently cause lock-ups with an MTU of over 2526
-+ */
-+#define GSWIP_MAX_PACKET_LENGTH	2556
-+
- struct gswip_hw_info {
- 	int max_ports;
- 	int cpu_port;
-@@ -856,10 +861,6 @@ static int gswip_setup(struct dsa_switch
- 	gswip_switch_mask(priv, 0, GSWIP_PCE_PCTRL_0_INGRESS,
- 			  GSWIP_PCE_PCTRL_0p(cpu_port));
- 
-	gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
-			  GSWIP_MAC_CTRL_2p(cpu_port));
-	gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8 + ETH_FCS_LEN,
-		       GSWIP_MAC_FLEN);
- 	gswip_switch_mask(priv, 0, GSWIP_BM_QUEUE_GCTRL_GL_MOD,
- 			  GSWIP_BM_QUEUE_GCTRL);
- 
-@@ -876,6 +877,8 @@ static int gswip_setup(struct dsa_switch
- 		return err;
- 	}
- 
-+	ds->mtu_enforcement_ingress = true;
-+
- 	gswip_port_enable(ds, cpu_port, NULL);
- 	return 0;
- }
-@@ -1438,6 +1441,39 @@ static int gswip_port_fdb_dump(struct ds
- 	return 0;
- }
- 
-+static int gswip_port_max_mtu(struct dsa_switch *ds, int port)
-+{
-+	/* includes 8 bytes for special header */
-+	return GSWIP_MAX_PACKET_LENGTH - VLAN_ETH_HLEN - ETH_FCS_LEN;
-+}
-+
-+static int gswip_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
-+{
-+	struct gswip_priv *priv = ds->priv;
-+	int cpu_port = priv->hw_info->cpu_port;
-+
-+	/* cpu port always has maximum mtu of user ports, so use it to set
-+	 * switch frame size, including 8 byte special header
-+	 */
-+	if (port == cpu_port) {
-+		new_mtu += 8;
-+		gswip_switch_w(priv, VLAN_ETH_HLEN + new_mtu + ETH_FCS_LEN,
-+			       GSWIP_MAC_FLEN);
-+	}
-+
-+	/* enable MLEN for ports with non-standard MTUs, including the special
-+	 * header on the CPU port added above
-+	 */
-+	if (new_mtu != ETH_DATA_LEN)
-+		gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
-+				  GSWIP_MAC_CTRL_2p(port));
-+	else
-+		gswip_switch_mask(priv, GSWIP_MAC_CTRL_2_MLEN, 0,
-+				  GSWIP_MAC_CTRL_2p(port));
-+
-+	return 0;
-+}
-+
- static void gswip_phylink_validate(struct dsa_switch *ds, int port,
- 				   unsigned long *supported,
- 				   struct phylink_link_state *state)
-@@ -1781,6 +1817,8 @@ static const struct dsa_switch_ops gswip
- 	.port_fdb_add		= gswip_port_fdb_add,
- 	.port_fdb_del		= gswip_port_fdb_del,
- 	.port_fdb_dump		= gswip_port_fdb_dump,
-+	.port_change_mtu	= gswip_port_change_mtu,
-+	.port_max_mtu		= gswip_port_max_mtu,
- 	.phylink_validate	= gswip_phylink_validate,
- 	.phylink_mac_config	= gswip_phylink_mac_config,
- 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
--- a/target/linux/lantiq/patches-5.10/0703-v5.16-net-lantiq_xrx200-increase-buffer-reservation.patch
+++ b/target/linux/lantiq/patches-5.10/0703-v5.16-net-lantiq_xrx200-increase-buffer-reservation.patch
--- a/target/linux/lantiq/patches-5.10/0704-v5.17-net-lantiq_xrx200-add-ingress-SG-DMA-support.patch
+++ b/target/linux/lantiq/patches-5.10/0704-v5.17-net-lantiq_xrx200-add-ingress-SG-DMA-support.patch
--- a/target/linux/lantiq/patches-5.10/0705-v5.13-net-dsa-lantiq-allow-to-use-all-GPHYs-on-xRX300-and-.patch
+++ b/target/linux/lantiq/patches-5.10/0705-v5.13-net-dsa-lantiq-allow-to-use-all-GPHYs-on-xRX300-and-.patch
@ -0,0 +1,275 @@
+From a09d042b086202735c4ed64573cdd79933020001 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Mon, 22 Mar 2021 21:37:15 +0100
+Subject: [PATCH] net: dsa: lantiq: allow to use all GPHYs on xRX300 and xRX330
+
+This patch allows to use all PHYs on GRX300 and GRX330. The ARX300
+has 3 and the GRX330 has 4 integrated PHYs connected to different
+ports compared to VRX200. Each integrated PHY can work as single
+Gigabit Ethernet PHY (GMII) or as double Fast Ethernet PHY (MII).
+
+Allowed port configurations:
+
+xRX200:
+GMAC0: RGMII, MII, REVMII or RMII port
+GMAC1: RGMII, MII, REVMII or RMII port
+GMAC2: GPHY0 (GMII)
+GMAC3: GPHY0 (MII)
+GMAC4: GPHY1 (GMII)
+GMAC5: GPHY1 (MII) or RGMII port
+
+xRX300:
+GMAC0: RGMII port
+GMAC1: GPHY2 (GMII)
+GMAC2: GPHY0 (GMII)
+GMAC3: GPHY0 (MII)
+GMAC4: GPHY1 (GMII)
+GMAC5: GPHY1 (MII) or RGMII port
+
+xRX330:
+GMAC0: RGMII, GMII or RMII port
+GMAC1: GPHY2 (GMII)
+GMAC2: GPHY0 (GMII)
+GMAC3: GPHY0 (MII) or GPHY3 (GMII)
+GMAC4: GPHY1 (GMII)
+GMAC5: GPHY1 (MII), RGMII or RMII port
+
+Tested on D-Link DWR966 (xRX330) with OpenWRT.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/lantiq_gswip.c | 142 ++++++++++++++++++++++++++-------
+ 1 file changed, 113 insertions(+), 29 deletions(-)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * Lantiq / Intel GSWIP switch driver for VRX200 SoCs
+ * Lantiq / Intel GSWIP switch driver for VRX200, xRX300 and xRX330 SoCs
+  *
+  * Copyright (C) 2010 Lantiq Deutschland
+  * Copyright (C) 2012 John Crispin <john@phrozen.org>
+@@ -104,6 +104,7 @@
+ #define  GSWIP_MII_CFG_MODE_RMIIP	0x2
+ #define  GSWIP_MII_CFG_MODE_RMIIM	0x3
+ #define  GSWIP_MII_CFG_MODE_RGMII	0x4
+#define  GSWIP_MII_CFG_MODE_GMII	0x9
+ #define  GSWIP_MII_CFG_MODE_MASK	0xf
+ #define  GSWIP_MII_CFG_RATE_M2P5	0x00
+ #define  GSWIP_MII_CFG_RATE_M25	0x10
+@@ -241,6 +242,7 @@
+ struct gswip_hw_info {
+ 	int max_ports;
+ 	int cpu_port;
+	const struct dsa_switch_ops *ops;
+ };
+ 
+ struct xway_gphy_match_data {
+@@ -1438,12 +1440,42 @@ static int gswip_port_fdb_dump(struct ds
+ 	return 0;
+ }
+ 
+-static void gswip_phylink_validate(struct dsa_switch *ds, int port,
+-				   unsigned long *supported,
+-				   struct phylink_link_state *state)
+static void gswip_phylink_set_capab(unsigned long *supported,
+				    struct phylink_link_state *state)
+ {
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+ 
+	/* Allow all the expected bits */
+	phylink_set(mask, Autoneg);
+	phylink_set_port_modes(mask);
+	phylink_set(mask, Pause);
+	phylink_set(mask, Asym_Pause);
+
+	/* With the exclusion of MII, Reverse MII and Reduced MII, we
+	 * support Gigabit, including Half duplex
+	 */
+	if (state->interface != PHY_INTERFACE_MODE_MII &&
+	    state->interface != PHY_INTERFACE_MODE_REVMII &&
+	    state->interface != PHY_INTERFACE_MODE_RMII) {
+		phylink_set(mask, 1000baseT_Full);
+		phylink_set(mask, 1000baseT_Half);
+	}
+
+	phylink_set(mask, 10baseT_Half);
+	phylink_set(mask, 10baseT_Full);
+	phylink_set(mask, 100baseT_Half);
+	phylink_set(mask, 100baseT_Full);
+
+	bitmap_and(supported, supported, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+	bitmap_and(state->advertising, state->advertising, mask,
+		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+}
+
+static void gswip_xrx200_phylink_validate(struct dsa_switch *ds, int port,
+					  unsigned long *supported,
+					  struct phylink_link_state *state)
+{
+ 	switch (port) {
+ 	case 0:
+ 	case 1:
+@@ -1470,38 +1502,54 @@ static void gswip_phylink_validate(struc
+ 		return;
+ 	}
+ 
+-	/* Allow all the expected bits */
+-	phylink_set(mask, Autoneg);
+-	phylink_set_port_modes(mask);
+-	phylink_set(mask, Pause);
+-	phylink_set(mask, Asym_Pause);
+	gswip_phylink_set_capab(supported, state);
+ 
+-	/* With the exclusion of MII, Reverse MII and Reduced MII, we
+-	 * support Gigabit, including Half duplex
+-	 */
+-	if (state->interface != PHY_INTERFACE_MODE_MII &&
+-	    state->interface != PHY_INTERFACE_MODE_REVMII &&
+-	    state->interface != PHY_INTERFACE_MODE_RMII) {
+-		phylink_set(mask, 1000baseT_Full);
+-		phylink_set(mask, 1000baseT_Half);
+	return;
+
+unsupported:
+	bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+	dev_err(ds->dev, "Unsupported interface '%s' for port %d\n",
+		phy_modes(state->interface), port);
+}
+
+static void gswip_xrx300_phylink_validate(struct dsa_switch *ds, int port,
+					  unsigned long *supported,
+					  struct phylink_link_state *state)
+{
+	switch (port) {
+	case 0:
+		if (!phy_interface_mode_is_rgmii(state->interface) &&
+		    state->interface != PHY_INTERFACE_MODE_GMII &&
+		    state->interface != PHY_INTERFACE_MODE_RMII)
+			goto unsupported;
+		break;
+	case 1:
+	case 2:
+	case 3:
+	case 4:
+		if (state->interface != PHY_INTERFACE_MODE_INTERNAL)
+			goto unsupported;
+		break;
+	case 5:
+		if (!phy_interface_mode_is_rgmii(state->interface) &&
+		    state->interface != PHY_INTERFACE_MODE_INTERNAL &&
+		    state->interface != PHY_INTERFACE_MODE_RMII)
+			goto unsupported;
+		break;
+	default:
+		bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+		dev_err(ds->dev, "Unsupported port: %i\n", port);
+		return;
+ 	}
+ 
+-	phylink_set(mask, 10baseT_Half);
+-	phylink_set(mask, 10baseT_Full);
+-	phylink_set(mask, 100baseT_Half);
+-	phylink_set(mask, 100baseT_Full);
+	gswip_phylink_set_capab(supported, state);
+ 
+-	bitmap_and(supported, supported, mask,
+-		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+-	bitmap_and(state->advertising, state->advertising, mask,
+-		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+ 	return;
+ 
+ unsupported:
+ 	bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+ 	dev_err(ds->dev, "Unsupported interface '%s' for port %d\n",
+ 		phy_modes(state->interface), port);
+-	return;
+ }
+ 
+ static void gswip_port_set_link(struct gswip_priv *priv, int port, bool link)
+@@ -1639,6 +1687,9 @@ static void gswip_phylink_mac_config(str
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+ 		miicfg |= GSWIP_MII_CFG_MODE_RGMII;
+ 		break;
+	case PHY_INTERFACE_MODE_GMII:
+		miicfg |= GSWIP_MII_CFG_MODE_GMII;
+		break;
+ 	default:
+ 		dev_err(ds->dev,
+ 			"Unsupported interface: %d\n", state->interface);
+@@ -1765,7 +1816,7 @@ static int gswip_get_sset_count(struct d
+ 	return ARRAY_SIZE(gswip_rmon_cnt);
+ }
+ 
+-static const struct dsa_switch_ops gswip_switch_ops = {
+static const struct dsa_switch_ops gswip_xrx200_switch_ops = {
+ 	.get_tag_protocol	= gswip_get_tag_protocol,
+ 	.setup			= gswip_setup,
+ 	.port_enable		= gswip_port_enable,
+@@ -1781,7 +1832,31 @@ static const struct dsa_switch_ops gswip
+ 	.port_fdb_add		= gswip_port_fdb_add,
+ 	.port_fdb_del		= gswip_port_fdb_del,
+ 	.port_fdb_dump		= gswip_port_fdb_dump,
+-	.phylink_validate	= gswip_phylink_validate,
+	.phylink_validate	= gswip_xrx200_phylink_validate,
+	.phylink_mac_config	= gswip_phylink_mac_config,
+	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
+	.phylink_mac_link_up	= gswip_phylink_mac_link_up,
+	.get_strings		= gswip_get_strings,
+	.get_ethtool_stats	= gswip_get_ethtool_stats,
+	.get_sset_count		= gswip_get_sset_count,
+};
+
+static const struct dsa_switch_ops gswip_xrx300_switch_ops = {
+	.get_tag_protocol	= gswip_get_tag_protocol,
+	.setup			= gswip_setup,
+	.port_enable		= gswip_port_enable,
+	.port_disable		= gswip_port_disable,
+	.port_bridge_join	= gswip_port_bridge_join,
+	.port_bridge_leave	= gswip_port_bridge_leave,
+	.port_fast_age		= gswip_port_fast_age,
+	.port_vlan_filtering	= gswip_port_vlan_filtering,
+	.port_vlan_add		= gswip_port_vlan_add,
+	.port_vlan_del		= gswip_port_vlan_del,
+	.port_stp_state_set	= gswip_port_stp_state_set,
+	.port_fdb_add		= gswip_port_fdb_add,
+	.port_fdb_del		= gswip_port_fdb_del,
+	.port_fdb_dump		= gswip_port_fdb_dump,
+	.phylink_validate	= gswip_xrx300_phylink_validate,
+ 	.phylink_mac_config	= gswip_phylink_mac_config,
+ 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
+ 	.phylink_mac_link_up	= gswip_phylink_mac_link_up,
+@@ -2043,7 +2118,7 @@ static int gswip_probe(struct platform_d
+ 	priv->ds->dev = dev;
+ 	priv->ds->num_ports = priv->hw_info->max_ports;
+ 	priv->ds->priv = priv;
+-	priv->ds->ops = &gswip_switch_ops;
+	priv->ds->ops = priv->hw_info->ops;
+ 	priv->dev = dev;
+ 	version = gswip_switch_r(priv, GSWIP_VERSION);
+ 
+@@ -2127,10 +2202,19 @@ static int gswip_remove(struct platform_
+ static const struct gswip_hw_info gswip_xrx200 = {
+ 	.max_ports = 7,
+ 	.cpu_port = 6,
+	.ops = &gswip_xrx200_switch_ops,
+};
+
+static const struct gswip_hw_info gswip_xrx300 = {
+	.max_ports = 7,
+	.cpu_port = 6,
+	.ops = &gswip_xrx300_switch_ops,
+ };
+ 
+ static const struct of_device_id gswip_of_match[] = {
+ 	{ .compatible = "lantiq,xrx200-gswip", .data = &gswip_xrx200 },
+	{ .compatible = "lantiq,xrx300-gswip", .data = &gswip_xrx300 },
+	{ .compatible = "lantiq,xrx330-gswip", .data = &gswip_xrx300 },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, gswip_of_match);
--- a/target/linux/lantiq/patches-5.10/0706-v5.18-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
+++ b/target/linux/lantiq/patches-5.10/0706-v5.18-net-lantiq-enable-jumbo-frames-on-GSWIP.patch
@ -0,0 +1,127 @@
+From c40bb4fedcd6b8b6a714da5dd466eb88ed2652d1 Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Wed, 9 Mar 2022 00:04:57 +0100
+Subject: net: dsa: lantiq_gswip: enable jumbo frames on GSWIP
+
+This enables non-standard MTUs on a per-port basis, with the overall
+frame size set based on the CPU port.
+
+When the MTU is not changed, this should have no effect.
+
+Long packets crash the switch with MTUs of greater than 2526, so the
+maximum is limited for now. Medium packets are sometimes dropped (e.g.
+TCP over 2477, UDP over 2516-2519, ICMP over 2526), Hence an MTU value
+of 2400 seems safe.
+
+Signed-off-by: Thomas Nixon <tom@tomn.co.uk>
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Link: https://lore.kernel.org/r/20220308230457.1599237-1-olek2@wp.pl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 53 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 49 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -213,6 +213,7 @@
+ #define  GSWIP_MAC_CTRL_0_GMII_MII	0x0001
+ #define  GSWIP_MAC_CTRL_0_GMII_RGMII	0x0002
+ #define GSWIP_MAC_CTRL_2p(p)		(0x905 + ((p) * 0xC))
+#define GSWIP_MAC_CTRL_2_LCHKL		BIT(2) /* Frame Length Check Long Enable */
+ #define GSWIP_MAC_CTRL_2_MLEN		BIT(3) /* Maximum Untagged Frame Lnegth */
+ 
+ /* Ethernet Switch Fetch DMA Port Control Register */
+@@ -239,6 +240,15 @@
+ 
+ #define XRX200_GPHY_FW_ALIGN	(16 * 1024)
+ 
+/* Maximum packet size supported by the switch. In theory this should be 10240,
+ * but long packets currently cause lock-ups with an MTU of over 2526. Medium
+ * packets are sometimes dropped (e.g. TCP over 2477, UDP over 2516-2519, ICMP
+ * over 2526), hence an MTU value of 2400 seems safe. This issue only affects
+ * packet reception. This is probably caused by the PPA engine, which is on the
+ * RX part of the device. Packet transmission works properly up to 10240.
+ */
+#define GSWIP_MAX_PACKET_LENGTH	2400
+
+ struct gswip_hw_info {
+ 	int max_ports;
+ 	int cpu_port;
+@@ -858,10 +868,6 @@ static int gswip_setup(struct dsa_switch
+ 	gswip_switch_mask(priv, 0, GSWIP_PCE_PCTRL_0_INGRESS,
+ 			  GSWIP_PCE_PCTRL_0p(cpu_port));
+ 
+-	gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
+-			  GSWIP_MAC_CTRL_2p(cpu_port));
+-	gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8 + ETH_FCS_LEN,
+-		       GSWIP_MAC_FLEN);
+ 	gswip_switch_mask(priv, 0, GSWIP_BM_QUEUE_GCTRL_GL_MOD,
+ 			  GSWIP_BM_QUEUE_GCTRL);
+ 
+@@ -878,6 +884,8 @@ static int gswip_setup(struct dsa_switch
+ 		return err;
+ 	}
+ 
+	ds->mtu_enforcement_ingress = true;
+
+ 	gswip_port_enable(ds, cpu_port, NULL);
+ 	return 0;
+ }
+@@ -1472,6 +1480,39 @@ static void gswip_phylink_set_capab(unsi
+ 		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+ }
+ 
+static int gswip_port_max_mtu(struct dsa_switch *ds, int port)
+{
+	/* Includes 8 bytes for special header. */
+	return GSWIP_MAX_PACKET_LENGTH - VLAN_ETH_HLEN - ETH_FCS_LEN;
+}
+
+static int gswip_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+{
+	struct gswip_priv *priv = ds->priv;
+	int cpu_port = priv->hw_info->cpu_port;
+
+	/* CPU port always has maximum mtu of user ports, so use it to set
+	 * switch frame size, including 8 byte special header.
+	 */
+	if (port == cpu_port) {
+		new_mtu += 8;
+		gswip_switch_w(priv, VLAN_ETH_HLEN + new_mtu + ETH_FCS_LEN,
+			       GSWIP_MAC_FLEN);
+	}
+
+	/* Enable MLEN for ports with non-standard MTUs, including the special
+	 * header on the CPU port added above.
+	 */
+	if (new_mtu != ETH_DATA_LEN)
+		gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
+				  GSWIP_MAC_CTRL_2p(port));
+	else
+		gswip_switch_mask(priv, GSWIP_MAC_CTRL_2_MLEN, 0,
+				  GSWIP_MAC_CTRL_2p(port));
+
+	return 0;
+}
+
+ static void gswip_xrx200_phylink_validate(struct dsa_switch *ds, int port,
+ 					  unsigned long *supported,
+ 					  struct phylink_link_state *state)
+@@ -1832,6 +1873,8 @@ static const struct dsa_switch_ops gswip
+ 	.port_fdb_add		= gswip_port_fdb_add,
+ 	.port_fdb_del		= gswip_port_fdb_del,
+ 	.port_fdb_dump		= gswip_port_fdb_dump,
+	.port_change_mtu	= gswip_port_change_mtu,
+	.port_max_mtu		= gswip_port_max_mtu,
+ 	.phylink_validate	= gswip_xrx200_phylink_validate,
+ 	.phylink_mac_config	= gswip_phylink_mac_config,
+ 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
+@@ -1856,6 +1899,8 @@ static const struct dsa_switch_ops gswip
+ 	.port_fdb_add		= gswip_port_fdb_add,
+ 	.port_fdb_del		= gswip_port_fdb_del,
+ 	.port_fdb_dump		= gswip_port_fdb_dump,
+	.port_change_mtu	= gswip_port_change_mtu,
+	.port_max_mtu		= gswip_port_max_mtu,
+ 	.phylink_validate	= gswip_xrx300_phylink_validate,
+ 	.phylink_mac_config	= gswip_phylink_mac_config,
+ 	.phylink_mac_link_down	= gswip_phylink_mac_link_down,
--- a/target/linux/mediatek/patches-5.10/510-net-mediatek-add-flow-offload-for-mt7623.patch
+++ b/target/linux/mediatek/patches-5.10/510-net-mediatek-add-flow-offload-for-mt7623.patch
@ -14,7 +14,7 @@ Signed-off-by: Frank Wunderlich <frank-w@public-files.de>

 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3302,6 +3302,7 @@ static const struct mtk_soc_data mt7623_
+@@ -3304,6 +3304,7 @@ static const struct mtk_soc_data mt7623_
 	.hw_features = MTK_HW_FEATURES,
 	.required_clks = MT7623_CLKS_BITMAP,
 	.required_pctl = true,
--- a/target/linux/mpc85xx/base-files/etc/board.d/01_leds
+++ b/target/linux/mpc85xx/base-files/etc/board.d/01_leds
@ -0,0 +1,19 @@
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board=$(board_name)
+boardname="${board##*,}"
+
+board_config_update
+
+case $board in
+extreme-networks,ws-ap3825i)
+	ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "eth1"
+	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "eth0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
--- a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3825i.dts
@ -26,72 +26,49 @@
 		device_type = "memory";
 	};

-	led_spi {
-		/*
-		 * This is currently non-functioning because the spi-gpio
-		 * driver refuses to register when presented with this node.
-		 */
-		compatible = "spi-gpio";
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		sck-gpios = <&gpio0 14 GPIO_ACTIVE_HIGH>;
-		mosi-gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
-		num-chipselects = <0>;
-
-		spi_gpio: led_gpio@0 {
-			compatible = "fairchild,74hc595";
-			reg = <0>;
-			gpio-controller;
-			#gpio-cells = <2>;
-			registers-number = <1>;
-			spi-max-frequency = <100000>;
-		};
-	};
-
 	leds {
 		compatible = "gpio-leds";

 		wifi1 {
 			gpios = <&spi_gpio 3 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:green:radio1";
+			label = "green:radio1";
 			linux,default-trigger = "phy0tpt";
 		};

 		wifi2 {
 			gpios = <&spi_gpio 2 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:green:radio2";
+			label = "green:radio2";
 			linux,default-trigger = "phy1tpt";
 		};

 		led_power_green: power_green {
 			gpios = <&spi_gpio 0 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:green:power";
+			label = "green:power";
 		};

 		led_power_red: power_red {
 			gpios = <&spi_gpio 1 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:red:power";
+			label = "red:power";
 		};

-		eth0_red {
+		lan1_red {
 			gpios = <&spi_gpio 6 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:red:eth0";
+			label = "red:lan1";
 		};

-		eth0_green {
+		lan1_green {
 			gpios = <&spi_gpio 4 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:green:eth0";
+			label = "green:lan1";
 		};

-		eth1_red {
+		lan2_red {
 			gpios = <&spi_gpio 7 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:red:eth1";
+			label = "red:lan2";
 		};

-		eth1_green {
+		lan2_green {
 			gpios = <&spi_gpio 5 GPIO_ACTIVE_HIGH>;
-			label = "ws-ap3825i:green:eth1";
+			label = "green:lan2";
 		};
 	};

@ -246,4 +223,29 @@
 	};
 };

+&soc {
+	led_spi {
+		/*
+		 * This is currently non-functioning because the spi-gpio
+		 * driver refuses to register when presented with this node.
+		 */
+		compatible = "spi-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		sck-gpios = <&gpio0 14 GPIO_ACTIVE_HIGH>;
+		mosi-gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
+		num-chipselects = <0>;
+
+		spi_gpio: led_gpio@0 {
+			compatible = "fairchild,74hc595";
+			reg = <0>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			registers-number = <1>;
+			spi-max-frequency = <100000>;
+		};
+	};
+};
+
 /include/ "fsl/p1020si-post.dtsi"
--- a/target/linux/mvebu/image/cortexa53.mk
+++ b/target/linux/mvebu/image/cortexa53.mk
@ -82,10 +82,10 @@ define Device/methode_udpu
  DEVICE_VENDOR := Methode
  DEVICE_MODEL := micro-DPU (uDPU)
  DEVICE_DTS := armada-3720-uDPU
-  KERNEL_LOADADDR := 0x00080000
+  KERNEL_LOADADDR := 0x00800000
  KERNEL_INITRAMFS := kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
  KERNEL_INITRAMFS_SUFFIX := .itb
-  DEVICE_PACKAGES += f2fs-tools fdisk kmod-i2c-pxa
+  DEVICE_PACKAGES += f2fs-tools fdisk kmod-i2c-pxa kmod-hwmon-lm75
  DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(2)
  IMAGES := firmware.tgz
  IMAGE/firmware.tgz := boot-scr | boot-img-ext4 | uDPU-firmware | append-metadata
--- a/target/linux/qoriq/config-5.10
+++ b/target/linux/qoriq/config-5.10
@ -140,7 +140,6 @@ CONFIG_FS_POSIX_ACL=y
 CONFIG_FTL=y
 CONFIG_FUNCTION_ERROR_INJECTION=y
 CONFIG_FW_LOADER_PAGED_BUF=y
-CONFIG_GDB_SCRIPTS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
--- a/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c
+++ b/target/linux/ramips/files/drivers/mtd/nand/raw/mt7621_nand.c
--- a/target/linux/ramips/mt7620/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7620/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@ -0,0 +1,26 @@
+[ "$ACTION" == "add" ] || exit 0
+
+PHYNBR=${DEVPATH##*/phy}
+
+[ -n $PHYNBR ] || exit 0
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board=$(board_name)
+
+case "$board" in
+	hiwifi,hc5661)
+		label_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
+		[ "$PHYNBR" = "0" ] && [ -n "$label_mac" ] && \
+		echo -n "$label_mac" > /sys${DEVPATH}/macaddress
+		;;
+	hiwifi,hc5761|\
+	hiwifi,hc5861)
+		label_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
+		[ "$PHYNBR" = "1" ] && [ -n "$label_mac" ] && \
+		echo -n "$label_mac" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "0" ] && [ -n "$label_mac" ] && \
+		macaddr_unsetbit "$label_mac" 6 > /sys${DEVPATH}/macaddress
+		;;
+esac
--- a/Show More
+++ b/Show More