Merge Official Source

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

include/kernel-6.6

@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .79
-LINUX_KERNEL_HASH-6.6.79 = 07a6f904470da1a099aa1683e3025a999dd82f2438f78b006b80c6ae2e9dfe8d
+LINUX_VERSION-6.6 = .83
+LINUX_KERNEL_HASH-6.6.83 = 894bbbe63b7484a0bc576a1e11a8dbc090fbd476d6424431bdc8435e03c2c208

include/optee-os.mk

@@ -85,7 +85,7 @@ endef
 
 define Build/Compile/Optee-os
 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
-		PATH=$(LINUX_DIR)/scripts/dtc/:$(PATH) \
+		PATH=$(LINUX_DIR)/scripts/dtc/:$(STAGING_DIR_HOST)/bin:$(PATH) \
 		CROSS_COMPILE=$(TARGET_CROSS) \
 		CROSS_COMPILE_core="$(TARGET_CROSS)" \
 		CROSS_COMPILE_ta_arm64="$(TARGET_CROSS)" \

package/boot/arm-trusted-firmware-mediatek/patches/0010-add-support-for-dosilicon-fmsh-gsto-spi-nand.patch

@@ -0,0 +1,36 @@
+--- a/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
++++ b/plat/mediatek/apsoc_common/drivers/spi_nand/mtk_spi_nand.c
+@@ -19,8 +19,11 @@
+ 
+ #define SPI_NAND_MAX_ID_LEN		4U
+ #define DELAY_US_400MS			400000U
++#define DOSILICON_ID			0xE5U
+ #define ETRON_ID			0xD5U
++#define FMSH_ID				0xA1U
+ #define GIGADEVICE_ID			0xC8U
++#define GSTO_ID				0x52U
+ #define MACRONIX_ID			0xC2U
+ #define MICRON_ID			0x2CU
+ #define TOSHIBA_ID			0x98U
+@@ -129,7 +132,10 @@ static int spi_nand_quad_enable(uint8_t
+ 
+ 	if (manufacturer_id != MACRONIX_ID &&
+ 	    manufacturer_id != GIGADEVICE_ID &&
++	    manufacturer_id != GSTO_ID &&
++	    manufacturer_id != DOSILICON_ID &&
+ 	    manufacturer_id != ETRON_ID &&
++	    manufacturer_id != FMSH_ID &&
+ 	    manufacturer_id != FORESEE_ID) {
+ 		return 0;
+ 	}
+@@ -364,6 +370,10 @@ static int spi_nand_check_pp(struct para
+ 		INFO("PP COPY %d CRC read: 0x%x, compute: 0x%x\n",
+ 		     i, crc, crc_compute);
+ 
++		// HACK: for FMSH
++		if (crc != crc_compute)
++			crc = htobe16(pp->integrity_crc);
++
+ 		if (crc != crc_compute) {
+ 			ret = -EBADMSG;
+ 			continue;

package/boot/uboot-envtools/files/ath79

@@ -85,6 +85,7 @@ yuncore,a930|\
 yuncore,xd3200|\
 yuncore,xd4200|\
 ziking,cpe46b|\
+zte,e8820|\
 zyxel,nbg6616)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	;;

package/boot/uboot-envtools/files/mediatek_filogic

@@ -43,6 +43,7 @@ jcg,q30-pro|\
 livinet,zr-3020-ubootmod|\
 mercusys,mr90x-v1-ubi|\
 netcore,n60|\
+netcore,n60-pro|\
 nokia,ea0326gmp|\
 qihoo,360t7|\
 routerich,ax3000-ubootmod|\
@@ -75,6 +76,7 @@ bananapi,bpi-r3-mini|\
 bananapi,bpi-r4|\
 bananapi,bpi-r4-poe|\
 cmcc,rax3000m|\
+cmcc,rax3000me|\
 jdcloud,re-cp-03|\
 konka,komi-a31)
 	. /lib/upgrade/fit.sh

package/boot/uboot-envtools/files/ramips

@@ -19,6 +19,7 @@ alfa-network,r36m-e4g|\
 alfa-network,tube-e4g|\
 engenius,epg600|\
 engenius,esr600h|\
+hongdian,h8922-v30|\
 linksys,re7000|\
 meig,slt866|\
 sitecom,wlr-4100-v1-002|\
@@ -148,7 +149,8 @@ xiaomi,mi-router-cr6608|\
 xiaomi,mi-router-cr6609)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
 	;;
-dna,valokuitu-plus-ex400)
+dna,valokuitu-plus-ex400|\
+genexis,pulse-ex400)
 	ubootenv_add_uci_config "/dev/ubi0_0" "0x0" "0x1f000" "0x1f000" "1"
 	ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
 	;;

package/boot/uboot-mediatek/Makefile

@@ -279,6 +279,42 @@ define U-Boot/mt7981_cmcc_rax3000m-nand
   DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr4
 endef
 
+define U-Boot/mt7981_cmcc_rax3000me-emmc
+  NAME:=CMCC RAX3000Me
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cmcc_rax3000me
+  UBOOT_CONFIG:=mt7981_cmcc_rax3000me-emmc
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=emmc
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-emmc-ddr3
+endef
+
+define U-Boot/mt7981_cmcc_rax3000me-nand-ddr3
+  NAME:=CMCC RAX3000Me
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cmcc_rax3000me
+  UBOOT_CONFIG:=mt7981_cmcc_rax3000me-nand-ddr3
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
+define U-Boot/mt7981_cmcc_rax3000me-nand-ddr4
+  NAME:=CMCC RAX3000Me
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cmcc_rax3000me
+  UBOOT_CONFIG:=mt7981_cmcc_rax3000me-nand-ddr4
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr4
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr4
+endef
+
 define U-Boot/mt7981_cudy_tr3000-v1
   NAME:=Cudy TR3000 v1
   BUILD_SUBTARGET:=filogic
@@ -690,6 +726,18 @@ define U-Boot/mt7986_netcore_n60
   DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr3
 endef
 
+define U-Boot/mt7986_netcore_n60-pro
+  NAME:=Netcore N60 Pro
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=netcore_n60-pro
+  UBOOT_CONFIG:=mt7986_netcore_n60-pro
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr4
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr4
+endef
+
 define U-Boot/mt7986_tplink_tl-xdr4288
   NAME:=TP-LINK TL-XDR4288
   BUILD_SUBTARGET:=filogic
@@ -932,6 +980,9 @@ UBOOT_TARGETS := \
 	mt7981_cmcc_a10 \
 	mt7981_cmcc_rax3000m-emmc \
 	mt7981_cmcc_rax3000m-nand \
+	mt7981_cmcc_rax3000me-emmc \
+	mt7981_cmcc_rax3000me-nand-ddr3 \
+	mt7981_cmcc_rax3000me-nand-ddr4 \
 	mt7981_cudy_tr3000-v1 \
 	mt7981_gatonetworks_gdsp \
 	mt7981_glinet_gl-x3000 \
@@ -965,6 +1016,7 @@ UBOOT_TARGETS := \
 	mt7986_jdcloud_re-cp-03 \
 	mt7986_mercusys_mr90x-v1 \
 	mt7986_netcore_n60 \
+	mt7986_netcore_n60-pro \
 	mt7986_tplink_tl-xdr4288 \
 	mt7986_tplink_tl-xdr6086 \
 	mt7986_tplink_tl-xdr6088 \

package/boot/uboot-mediatek/patches/101-01-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch

@@ -0,0 +1,149 @@
+From 49c8e854869d673df8452f24dfa8989cd0f615a8 Mon Sep 17 00:00:00 2001
+From: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Date: Mon, 2 Oct 2023 17:04:58 +0300
+Subject: [PATCH] mtd: spinand: add support for FORESEE F35SQA002G
+
+Add support for FORESEE F35SQA002G SPI NAND.
+Datasheet:
+  https://www.longsys.com/uploads/LM-00006FORESEEF35SQA002GDatasheet_1650183701.pdf
+
+Signed-off-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231002140458.147605-1-mmkurbanov@salutedevices.com
+---
+ drivers/mtd/nand/spi/Makefile  |  2 +-
+ drivers/mtd/nand/spi/core.c    |  1 +
+ drivers/mtd/nand/spi/foresee.c | 95 ++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h    |  1 +
+ 4 files changed, 98 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/foresee.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-spinand-objs := core.o esmt.o etron.o gigadevice.o macronix.o micron.o paragon.o
++spinand-objs := core.o esmt.o foresee.o etron.o gigadevice.o macronix.o micron.o paragon.o
+ spinand-objs += toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -834,6 +834,7 @@ static const struct spinand_manufacturer
+ 	&toshiba_spinand_manufacturer,
+ 	&winbond_spinand_manufacturer,
+ 	&esmt_c8_spinand_manufacturer,
++	&foresee_spinand_manufacturer,
+ 	&xtx_spinand_manufacturer,
+ };
+ 
+--- /dev/null
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -0,0 +1,97 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright (c) 2023, SberDevices. All Rights Reserved.
++ *
++ * Author: Martin Kurbanov <mmkurbanov@salutedevices.com>
++ */
++
++#ifndef __UBOOT__
++#include <linux/device.h>
++#include <linux/kernel.h>
++#endif
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_FORESEE		0xCD
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int f35sqa002g_ooblayout_ecc(struct mtd_info *mtd, int section,
++				    struct mtd_oob_region *region)
++{
++	return -ERANGE;
++}
++
++static int f35sqa002g_ooblayout_free(struct mtd_info *mtd, int section,
++				     struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	/* Reserve 2 bytes for the BBM. */
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops f35sqa002g_ooblayout = {
++	.ecc = f35sqa002g_ooblayout_ecc,
++	.rfree = f35sqa002g_ooblayout_free,
++};
++
++static int f35sqa002g_ecc_get_status(struct spinand_device *spinand, u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		return 1;
++
++	default:
++		break;
++	}
++
++	/* More than 1-bit error was detected in one or more sectors and
++	 * cannot be corrected.
++	 */
++	return -EBADMSG;
++}
++
++static const struct spinand_info foresee_spinand_table[] = {
++	SPINAND_INFO("F35SQA002G",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x72, 0x72),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
++				     f35sqa002g_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops foresee_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer foresee_spinand_manufacturer = {
++	.id = SPINAND_MFR_FORESEE,
++	.name = "FORESEE",
++	.chips = foresee_spinand_table,
++	.nchips = ARRAY_SIZE(foresee_spinand_table),
++	.ops = &foresee_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -252,6 +252,7 @@ extern const struct spinand_manufacturer
+ extern const struct spinand_manufacturer toshiba_spinand_manufacturer;
+ extern const struct spinand_manufacturer winbond_spinand_manufacturer;
+ extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
++extern const struct spinand_manufacturer foresee_spinand_manufacturer;
+ extern const struct spinand_manufacturer xtx_spinand_manufacturer;
+ 
+ /**

package/boot/uboot-mediatek/patches/101-02-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch

@@ -0,0 +1,38 @@
+From ae461cde5c559675fc4c0ba351c7c31ace705f56 Mon Sep 17 00:00:00 2001
+From: Bohdan Chubuk <chbgdn@gmail.com>
+Date: Sun, 10 Nov 2024 22:50:47 +0200
+Subject: [PATCH] mtd: spinand: add support for FORESEE F35SQA001G
+
+Add support for FORESEE F35SQA001G SPI NAND.
+
+Similar to F35SQA002G, but differs in capacity.
+Datasheet:
+  -  https://cdn.ozdisan.com/ETicaret_Dosya/704795_871495.pdf
+
+Tested on Xiaomi AX3000T flashed with OpenWRT.
+
+Signed-off-by: Bohdan Chubuk <chbgdn@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+---
+ drivers/mtd/nand/spi/foresee.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/nand/spi/foresee.c
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -83,6 +83,16 @@ static const struct spinand_info foresee
+ 		     SPINAND_HAS_QE_BIT,
+ 		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
+ 				     f35sqa002g_ecc_get_status)),
++	SPINAND_INFO("F35SQA001G",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x71, 0x71),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
++				     f35sqa002g_ecc_get_status)),
+ };
+ 
+ static const struct spinand_manufacturer_ops foresee_spinand_manuf_ops = {

package/boot/uboot-mediatek/patches/341-mtd-spinand-Support-dosilicon.patch

@@ -0,0 +1,332 @@
+From cead43cc5781492f2706eeed1157c8986a216bc9 Mon Sep 17 00:00:00 2001
+From: Jon Lin <jon.lin@rock-chips.com>
+Date: Sun, 17 Oct 2021 09:51:39 +0800
+Subject: [PATCH] mtd: spinand: Support dosilicon
+
+DS35X1GA, DS35Q2GA, DS35M1GA, DS35M2GA, DS35Q2GB, DS35M1GB
+
+Change-Id: I5aeb0219f01dbe98d36b398e66b94ab31b07788e
+Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
+---
+ drivers/mtd/nand/spi/Makefile    |   2 +-
+ drivers/mtd/nand/spi/core.c      |   1 +
+ drivers/mtd/nand/spi/dosilicon.c | 187 +++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h      |   1 +
+ 4 files changed, 190 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/dosilicon.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ spinand-objs := core.o esmt.o foresee.o etron.o gigadevice.o macronix.o micron.o paragon.o
++spinand-objs += dosilicon.o
+ spinand-objs += toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -826,6 +826,7 @@ static const struct nand_ops spinand_ops
+ };
+ 
+ static const struct spinand_manufacturer *spinand_manufacturers[] = {
++	&dosilicon_spinand_manufacturer,
+ 	&etron_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/dosilicon.c
+@@ -0,0 +1,283 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2020 Rockchip Electronics Co., Ltd.
++ */
++
++#ifndef __UBOOT__
++#include <linux/device.h>
++#include <linux/kernel.h>
++#endif
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_DOSILICON			0xE5
++
++#define DOSICON_STATUS_ECC_MASK			GENMASK(6, 4)
++#define DOSICON_STATUS_ECC_NO_BITFLIPS		(0 << 4)
++#define DOSICON_STATUS_ECC_1TO3_BITFLIPS	(1 << 4)
++#define DOSICON_STATUS_ECC_4TO6_BITFLIPS	(3 << 4)
++#define DOSICON_STATUS_ECC_7TO8_BITFLIPS	(5 << 4)
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static int ds35xxga_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = (16 * section) + 8;
++	region->length = 8;
++
++	return 0;
++}
++
++static int ds35xxga_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section > 3)
++		return -ERANGE;
++
++	region->offset = (16 * section) + 2;
++	region->length = 6;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops ds35xxga_ooblayout = {
++	.ecc = ds35xxga_ooblayout_ecc,
++	.rfree = ds35xxga_ooblayout_free,
++};
++
++static int ds35xxgb_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 64;
++	region->length = 64;
++
++	return 0;
++}
++
++static int ds35xxgb_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	/* Reserve 1 bytes for the BBM. */
++	region->offset = 1;
++	region->length = 63;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops ds35xxgb_ooblayout = {
++	.ecc = ds35xxgb_ooblayout_ecc,
++	.rfree = ds35xxgb_ooblayout_free,
++};
++
++static int ds35xxgb_ecc_get_status(struct spinand_device *spinand,
++				   u8 status)
++{
++	switch (status & DOSICON_STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_UNCOR_ERROR:
++		return -EBADMSG;
++
++	case DOSICON_STATUS_ECC_1TO3_BITFLIPS:
++		return 3;
++
++	case DOSICON_STATUS_ECC_4TO6_BITFLIPS:
++		return 6;
++
++	case DOSICON_STATUS_ECC_7TO8_BITFLIPS:
++		return 8;
++
++	default:
++		break;
++	}
++
++	return -EINVAL;
++}
++
++static const struct spinand_info dosilicon_spinand_table[] = {
++	SPINAND_INFO("DS35X1GA",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x71),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxga_ooblayout, NULL)),
++	SPINAND_INFO("DS35Q2GA",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x72),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 2, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxga_ooblayout, NULL)),
++	SPINAND_INFO("DS35M1GA",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x21),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxga_ooblayout, NULL)),
++	SPINAND_INFO("DS35M2GA",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x22),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 2, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxga_ooblayout, NULL)),
++	SPINAND_INFO("DS35Q2GB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xF2),
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 2, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35M1GB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xA1),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q1GB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xF1),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q4GM",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xF4),
++		     NAND_MEMORG(1, 2048, 128, 64, 4096, 80, 2, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q12B",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xF5),
++		     NAND_MEMORG(1, 2048, 128, 64, 512, 10, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35M12B",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xA5),
++		     NAND_MEMORG(1, 2048, 128, 64, 512, 10, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout,
++				     ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q1GD-IB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x51),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35M4GB-IB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x64),
++		     NAND_MEMORG(1, 2048, 128, 64, 4096, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q4GB-IB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xB4),
++		     NAND_MEMORG(1, 2048, 128, 64, 4096, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q12C-IB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x75),
++		     NAND_MEMORG(1, 2048, 128, 64, 512, 10, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35M12C-IB",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x25),
++		     NAND_MEMORG(1, 2048, 128, 64, 512, 10, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++	SPINAND_INFO("DS35Q2GBS",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xB2),
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&ds35xxgb_ooblayout, ds35xxgb_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops dosilicon_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer dosilicon_spinand_manufacturer = {
++	.id = SPINAND_MFR_DOSILICON,
++	.name = "dosilicon",
++	.chips = dosilicon_spinand_table,
++	.nchips = ARRAY_SIZE(dosilicon_spinand_table),
++	.ops = &dosilicon_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -244,6 +244,7 @@ struct spinand_manufacturer {
+ };
+ 
+ /* SPI NAND manufacturers */
++extern const struct spinand_manufacturer dosilicon_spinand_manufacturer;
+ extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;

package/boot/uboot-mediatek/patches/342-mtd-spinand-Support-fmsh.patch

@@ -0,0 +1,290 @@
+From 205a24e34751220c3ba04f0ac6ecc734e56ed225 Mon Sep 17 00:00:00 2001
+From: Jon Lin <jon.lin@rock-chips.com>
+Date: Sun, 17 Oct 2021 09:59:10 +0800
+Subject: [PATCH] mtd: spinand: Support fmsh
+
+FM25S01A, FM25S02A, FM25S01
+
+Change-Id: I7e0ceec39c57dc591d77a4ebde599ad326cf25b7
+Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
+---
+ drivers/mtd/nand/spi/Makefile |   2 +-
+ drivers/mtd/nand/spi/core.c   |   1 +
+ drivers/mtd/nand/spi/fmsh.c   | 122 ++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h   |   1 +
+ 4 files changed, 125 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/fmsh.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ spinand-objs := core.o esmt.o foresee.o etron.o gigadevice.o macronix.o micron.o paragon.o
+-spinand-objs += dosilicon.o
++spinand-objs += dosilicon.o fmsh.o
+ spinand-objs += toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -828,6 +828,7 @@ static const struct nand_ops spinand_ops
+ static const struct spinand_manufacturer *spinand_manufacturers[] = {
+ 	&dosilicon_spinand_manufacturer,
+ 	&etron_spinand_manufacturer,
++	&fmsh_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+ 	&micron_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/fmsh.c
+@@ -0,0 +1,240 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2020-2021 Rockchip Electronics Co., Ltd.
++ *
++ * Authors:
++ *	Dingqiang Lin <jon.lin@rock-chips.com>
++ */
++
++#ifndef __UBOOT__
++#include <linux/device.h>
++#include <linux/kernel.h>
++#endif
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_FMSH		0xA1
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int fm25s01a_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	return -ERANGE;
++}
++
++static int fm25s01a_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops fm25s01a_ooblayout = {
++	.ecc = fm25s01a_ooblayout_ecc,
++	.rfree = fm25s01a_ooblayout_free,
++};
++
++static int fm25s01_ooblayout_ecc(struct mtd_info *mtd, int section,
++				 struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 64;
++	region->length = 64;
++
++	return 0;
++}
++
++static int fm25s01_ooblayout_free(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops fm25s01_ooblayout = {
++	.ecc = fm25s01_ooblayout_ecc,
++	.rfree = fm25s01_ooblayout_free,
++};
++
++/*
++ * ecc bits: 0xC0[4,6]
++ * [0b000], No bit errors were detected;
++ * [0b001] and [0b011], 1~6 Bit errors were detected and corrected. Not
++ *	reach Flipping Bits;
++ * [0b101], Bit error count equals the bit flip
++ *	detection threshold
++ * [0b010], Multiple bit errors were detected and
++ *	not corrected.
++ * others, Reserved.
++ */
++static int fm25s01bi3_ecc_ecc_get_status(struct spinand_device *spinand,
++					u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++	u8 eccsr = (status & GENMASK(6, 4)) >> 4;
++
++	if (eccsr <= 1 || eccsr == 3)
++		return eccsr;
++	else if (eccsr == 5)
++		return nand->eccreq.strength;
++	else
++		return -EBADMSG;
++}
++
++static int fm25g0xd_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 64;
++	region->length = 64;
++
++	return 0;
++}
++
++static int fm25g0xd_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	/* Reserve 2 bytes for the BBM. */
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops fm25g0xd_ooblayout = {
++	.ecc = fm25g0xd_ooblayout_ecc,
++	.rfree = fm25g0xd_ooblayout_free,
++};
++
++/*
++ * ecc bits: 0xC0[4,6]
++ * [0x0], No bit errors were detected;
++ * [0x001, 0x011], Bit errors were detected and corrected. Not
++ *	reach Flipping Bits;
++ * [0x100], Bit error count equals the bit flip
++ *	detectionthreshold
++ * [0x101, 0x110], Reserved;
++ * [0x111], Multiple bit errors were detected and
++ *	not corrected.
++ */
++static int fm25g0xd_ecc_get_status(struct spinand_device *spinand,
++				   u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++	u8 eccsr = (status & GENMASK(6, 4)) >> 4;
++
++	if (eccsr <= 3)
++		return 0;
++	else if (eccsr == 4)
++		return nand->eccreq.strength;
++	else
++		return -EBADMSG;
++}
++
++static const struct spinand_info fmsh_spinand_table[] = {
++	SPINAND_INFO("FM25S01A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xE4),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&fm25s01a_ooblayout, NULL)),
++	SPINAND_INFO("FM25S02A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xE5),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 2, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&fm25s01a_ooblayout, NULL)),
++	SPINAND_INFO("FM25S01",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xA1),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&fm25s01_ooblayout, NULL)),
++	SPINAND_INFO("FM25LS01",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xA5),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&fm25s01_ooblayout, NULL)),
++	SPINAND_INFO("FM25S01BI3",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xD4),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&fm25s01_ooblayout, fm25s01bi3_ecc_ecc_get_status)),
++	SPINAND_INFO("FM25S02BI3-DND-A-G3",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xD6),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&fm25s01_ooblayout, fm25s01bi3_ecc_ecc_get_status)),
++	SPINAND_INFO("FM25G02D",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xF2),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&fm25g0xd_ooblayout, fm25g0xd_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops fmsh_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer fmsh_spinand_manufacturer = {
++	.id = SPINAND_MFR_FMSH,
++	.name = "FMSH",
++	.chips = fmsh_spinand_table,
++	.nchips = ARRAY_SIZE(fmsh_spinand_table),
++	.ops = &fmsh_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -246,6 +246,7 @@ struct spinand_manufacturer {
+ /* SPI NAND manufacturers */
+ extern const struct spinand_manufacturer dosilicon_spinand_manufacturer;
+ extern const struct spinand_manufacturer etron_spinand_manufacturer;
++extern const struct spinand_manufacturer fmsh_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
+ extern const struct spinand_manufacturer micron_spinand_manufacturer;

package/boot/uboot-mediatek/patches/343-mtd-spinand-gsto-Add-code.patch

@@ -0,0 +1,189 @@
+From 1e5200d59e21c8a8fa63badf415becb2301e78a4 Mon Sep 17 00:00:00 2001
+From: Jon Lin <jon.lin@rock-chips.com>
+Date: Thu, 27 Apr 2023 22:00:04 +0800
+Subject: [PATCH] mtd: spinand: gsto: Add code
+
+GSS01GSAK1, GSS02GSAK1
+
+Change-Id: I7ee9048d934694803d6d081cb7d0cdc56f114e79
+Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
+---
+ drivers/mtd/nand/spi/Makefile |  2 +-
+ drivers/mtd/nand/spi/core.c   |  1 +
+ drivers/mtd/nand/spi/gsto.c   | 90 +++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h   |  1 +
+ 4 files changed, 93 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/gsto.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ spinand-objs := core.o esmt.o foresee.o etron.o gigadevice.o macronix.o micron.o paragon.o
+-spinand-objs += dosilicon.o fmsh.o
++spinand-objs += dosilicon.o fmsh.o gsto.o
+ spinand-objs += toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -830,6 +830,7 @@ static const struct spinand_manufacturer
+ 	&etron_spinand_manufacturer,
+ 	&fmsh_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
++	&gsto_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+ 	&micron_spinand_manufacturer,
+ 	&paragon_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/gsto.c
+@@ -0,0 +1,139 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2023 Rockchip Electronics Co., Ltd.
++ *
++ * Authors:
++ *	Dingqiang Lin <jon.lin@rock-chips.com>
++ */
++
++#ifndef __UBOOT__
++#include <linux/device.h>
++#include <linux/kernel.h>
++#endif
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_GSTO		0x52
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int gss0xgsak1_ooblayout_ecc(struct mtd_info *mtd, int section,
++				 struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 32;
++	region->length = 32;
++
++	return 0;
++}
++
++static int gss0xgsak1_ooblayout_free(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 2;
++	region->length = 30;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops gss0xgsak1_ooblayout = {
++	.ecc = gss0xgsak1_ooblayout_ecc,
++	.rfree = gss0xgsak1_ooblayout_free,
++};
++
++static int gss0xgsax1_ooblayout_ecc(struct mtd_info *mtd, int section,
++				 struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 64;
++	region->length = 64;
++
++	return 0;
++}
++
++static int gss0xgsax1_ooblayout_free(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops gss0xgsax1_ooblayout = {
++	.ecc = gss0xgsax1_ooblayout_ecc,
++	.rfree = gss0xgsax1_ooblayout_free,
++};
++
++static const struct spinand_info gsto_spinand_table[] = {
++	SPINAND_INFO("GSS01GSAK1",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xBA, 0x13),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 10, 1, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&gss0xgsak1_ooblayout, NULL)),
++	SPINAND_INFO("GSS02GSAK1",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xBA, 0x23),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 20, 1, 1, 1),
++		     NAND_ECCREQ(4, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&gss0xgsax1_ooblayout, NULL)),
++	SPINAND_INFO("GSS02GSAX1",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xCA, 0x23),
++		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&gss0xgsax1_ooblayout, NULL)),
++	SPINAND_INFO("GSS01GSAX1",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xCA, 0x13),
++		     NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(8, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     0,
++		     SPINAND_ECCINFO(&gss0xgsax1_ooblayout, NULL)),
++};
++
++static const struct spinand_manufacturer_ops gsto_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer gsto_spinand_manufacturer = {
++	.id = SPINAND_MFR_GSTO,
++	.name = "GSTO",
++	.chips = gsto_spinand_table,
++	.nchips = ARRAY_SIZE(gsto_spinand_table),
++	.ops = &gsto_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -248,6 +248,7 @@ extern const struct spinand_manufacturer
+ extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer fmsh_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
++extern const struct spinand_manufacturer gsto_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
+ extern const struct spinand_manufacturer micron_spinand_manufacturer;
+ extern const struct spinand_manufacturer paragon_spinand_manufacturer;

package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch

@@ -187,13 +187,12 @@
  	leds {
  		compatible = "gpio-leds";
  
-@@ -109,6 +122,19 @@
+@@ -109,6 +122,18 @@
  		};
  	};
  
 +	key_pins_a: keys-alt {
 +		mux {
-+			function = "gpio";
 +			groups = "msdc3";
 +		};
 +

package/boot/uboot-mediatek/patches/454-add-glinet-x3000.patch

@@ -255,9 +255,9 @@
 +serverip=192.168.1.254
 +loadaddr=0x46000000
 +bootdelay=3
-+bootfile_bl2=openwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin
-+bootfile_fip=openwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip
-+bootfile_firmware=openwrt-mediatek-filogic-glinet_gl-x3000-squashfs-factory.bin
++bootfile_bl2=immortalwrt-mediatek-filogic-glinet_gl-x3000-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-glinet_gl-x3000-bl31-uboot.fip
++bootfile_firmware=immortalwrt-mediatek-filogic-glinet_gl-x3000-squashfs-factory.bin
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
 +bootmenu_title=      *** U-Boot Boot Menu for GL-iNet GL-X3000 ***
 +bootmenu_0=Startup system (Default).=run boot_system

package/boot/uboot-mediatek/patches/456-add-arcadyan-mozart.patch

@@ -131,10 +131,10 @@
 +bootconf=config-1
 +bootconf_extra=
 +bootdelay=0
-+bootfile=openwrt-mediatek-filogic-arcadyan_mozart-initramfs.itb
-+bootfile_bl2=openwrt-mediatek-filogic-arcadyan_mozart-emmc-preloader.bin
-+bootfile_fip=openwrt-mediatek-filogic-arcadyan_mozart-emmc-bl31-uboot.fip
-+bootfile_upg=openwrt-mediatek-filogic-arcadyan_mozart-squashfs-sysupgrade.itb
++bootfile=immortalwrt-mediatek-filogic-arcadyan_mozart-initramfs.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-arcadyan_mozart-emmc-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-arcadyan_mozart-emmc-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-arcadyan_mozart-squashfs-sysupgrade.itb
 +bootled_pwr=blue:status
 +bootled_rec=red:status
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60

package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch

@@ -378,8 +378,8 @@ Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
 +loadaddr=0x46000000
 +bootcmd=run boot_nor
 +bootdelay=0
-+bootfile=openwrt-mediatek-filogic-gatonetworks_gdsp-initramfs-kernel.bin
-+bootfile_upg=openwrt-mediatek-filogic-gatonetworks_gdsp-squashfs-sysupgrade.bin
++bootfile=immortalwrt-mediatek-filogic-gatonetworks_gdsp-initramfs-kernel.bin
++bootfile_upg=immortalwrt-mediatek-filogic-gatonetworks_gdsp-squashfs-sysupgrade.bin
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
 +bootmenu_default=0
 +bootmenu_delay=0

package/boot/uboot-mediatek/patches/459-add-mercusys-mr90x-v1.patch

@@ -296,10 +296,10 @@
 +bootcmd=run check_buttons ; run boot_production ; run boot_recovery
 +bootconf=config-1
 +bootdelay=0
-+bootfile=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
-+bootfile_bl2=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
-+bootfile_fip=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
-+bootfile_upg=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
++bootfile=immortalwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
 +bootmenu_default=0
 +bootmenu_delay=0

package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch

@@ -309,10 +309,10 @@
 +bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
 +bootconf=config-1
 +bootdelay=0
-+bootfile=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-initramfs-recovery.itb
-+bootfile_bl2=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-preloader.bin
-+bootfile_fip=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-bl31-uboot.fip
-+bootfile_upg=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-squashfs-sysupgrade.itb
++bootfile=immortalwrt-mediatek-filogic-routerich_ax3000-ubootmod-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-routerich_ax3000-ubootmod-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-routerich_ax3000-ubootmod-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-routerich_ax3000-ubootmod-squashfs-sysupgrade.itb
 +bootled_pwr=blue:power
 +bootled_rec=blue:power
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60

package/boot/uboot-mediatek/patches/461-add-netcore-n60-pro.patch

@@ -0,0 +1,396 @@
+--- /dev/null
++++ b/configs/mt7986_netcore_n60-pro_defconfig
+@@ -0,0 +1,130 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-netcore-n60-pro"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7986=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PCI=y
++CONFIG_DEBUG_UART=y
++CONFIG_AHCI=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-netcore-n60-pro.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="netcore_n60-pro_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SCSI_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_MTK_AHCI=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_RAM=y
++CONFIG_SCSI=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7986a-netcore-n60-pro.dts
+@@ -0,0 +1,200 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2021 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include "mt7986.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Netcore N60 Pro";
++	compatible = "mediatek,mt7986", "mediatek,mt7986-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x20000000>;
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		button-reset {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++
++		button-mesh {
++			label = "mesh";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio-leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "blue:wlan";
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		power_led: led-1 {
++			label = "blue:power";
++			gpios = <&gpio 29 GPIO_ACTIVE_LOW>;
++		};
++
++		led-2 {
++			label = "blue:status";
++			gpios = <&gpio 30 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			label = "blue:mesh";
++			gpios = <&gpio 31 GPIO_ACTIVE_LOW>;
++		};
++
++		led-4 {
++			label = "blue:wan";
++			gpios = <&gpio 32 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "disabled";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_2";
++		};
++	};
++
++	uart1_pins: spi1-pins-func-3 {
++		mux {
++			function = "uart";
++			groups = "uart1_2";
++		};
++	};
++
++	pwm_pins: pwm0-pins-func-1 {
++		mux {
++			function = "pwm";
++			groups = "pwm0";
++		};
++	};
++};
++
++&pwm {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pwm_pins>;
++	status = "okay";
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <1>;
++	sample_sel = <0>;
++
++	spi_nand@1 {
++		compatible = "spi-nand";
++		reg = <1>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "orig-env";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@180000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/netcore_n60-pro_env
+@@ -0,0 +1,57 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=immortalwrt-mediatek-filogic-netcore_n60-pro-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-netcore_n60-pro-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-netcore_n60-pro-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-netcore_n60-pro-squashfs-sysupgrade.itb
++bootled_pwr=blue:power
++bootled_rec=blue:power
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++ethaddr_factory=mtd read factory 0x40080000 0x1fe000 0x1000 && env readmem -b ethaddr 0x40080f20 0x6 ; setenv ethaddr_factory
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"

package/boot/uboot-mediatek/patches/471-add-cmcc_rax3000me.patch

@@ -0,0 +1,584 @@
+--- /dev/null
++++ b/configs/mt7981_cmcc_rax3000me-emmc_defconfig
+@@ -0,0 +1,125 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SIZE=0x40000
++CONFIG_ENV_OFFSET=0x400000
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-cmcc-rax3000me-emmc"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_ENV_OFFSET_REDUND=0x440000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PCI=y
++CONFIG_DEBUG_UART=y
++CONFIG_AHCI=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cmcc-rax3000me-emmc.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="cmcc_rax3000me-emmc_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SCSI_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_MTK_AHCI=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_SUPPORT_EMMC_BOOT=y
++CONFIG_MMC_HS200_SUPPORT=y
++CONFIG_MMC_MTK=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_RAM=y
++CONFIG_SCSI=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_LZO=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/configs/mt7981_cmcc_rax3000me-nand-ddr3_defconfig
+@@ -0,0 +1,125 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-cmcc-rax3000me-nand"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PCI=y
++CONFIG_DEBUG_UART=y
++CONFIG_AHCI=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cmcc-rax3000me-nand.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="cmcc_rax3000me-nand-ddr3_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SCSI_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_MTK_AHCI=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_RAM=y
++CONFIG_SCSI=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/configs/mt7981_cmcc_rax3000me-nand-ddr4_defconfig
+@@ -0,0 +1,125 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-cmcc-rax3000me-nand"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PCI=y
++CONFIG_DEBUG_UART=y
++CONFIG_AHCI=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cmcc-rax3000me-nand.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="cmcc_rax3000me-nand-ddr4_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_SCSI_AHCI=y
++CONFIG_AHCI_PCI=y
++CONFIG_MTK_AHCI=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PCIE_MEDIATEK=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7622=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_RAM=y
++CONFIG_SCSI=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7981-cmcc-rax3000me-emmc.dts
+@@ -0,0 +1,9 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++/dts-v1/;
++#include "mt7981-cmcc-rax3000m-emmc.dts"
++
++/ {
++	model = "CMCC RAX3000Me";
++	compatible = "cmcc,rax3000me", "mediatek,mt7981";
++};
+--- /dev/null
++++ b/arch/arm/dts/mt7981-cmcc-rax3000me-nand.dts
+@@ -0,0 +1,9 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++/dts-v1/;
++#include "mt7981-cmcc-rax3000m-nand.dts"
++
++/ {
++	model = "CMCC RAX3000Me";
++	compatible = "cmcc,rax3000me", "mediatek,mt7981";
++};
+--- /dev/null
++++ b/cmcc_rax3000me-emmc_env
+@@ -0,0 +1,55 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootargs=root=/dev/fit0 rootwait
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_emmc ; fi
++bootconf=config-1#mt7981b-cmcc-rax3000m-emmc
++bootdelay=0
++bootfile=immortalwrt-mediatek-filogic-cmcc_rax3000me-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-cmcc_rax3000me-squashfs-sysupgrade.itb
++bootled_pwr=red:status
++bootled_rec=blue:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [eMMC]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from eMMC.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from eMMC.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to eMMC.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to eMMC.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to eMMC.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to eMMC.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run emmc_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run emmc_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_emmc=run boot_production ; run boot_recovery
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run emmc_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run emmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run emmc_write_fip
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run emmc_write_bl2
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_read_vol=mmc read $loadaddr $part_addr 0x100 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
++part_default=production
++part_recovery=recovery
++reset_factory=eraseenv && reset
++emmc_read_production=part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_read_vol
++emmc_read_recovery=part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_read_vol
++emmc_write_bl2=mmc partconf 0 1 1 1 && mmc erase 0x0 0x400 && mmc write $fileaddr 0x0 0x400 ; mmc partconf 0 1 1 0
++emmc_write_fip=mmc erase 0x3400 0x2000 && mmc write $fileaddr 0x3400 0x2000 && mmc erase 0x2000 0x800
++emmc_write_production=part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_write_vol
++emmc_write_recovery=part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_write_vol
++_init_env=setenv _init_env ; setenv _create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/cmcc_rax3000me-nand-ddr3_env
+@@ -0,0 +1,56 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootconf=config-1#mt7981b-cmcc-rax3000m-nand
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootdelay=0
++bootfile=immortalwrt-mediatek-filogic-cmcc_rax3000me-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-cmcc_rax3000me-squashfs-sysupgrade.itb
++bootled_pwr=red:status
++bootled_rec=blue:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [SPI-NAND]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/cmcc_rax3000me-nand-ddr4_env
+@@ -0,0 +1,56 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootconf=config-1#mt7981b-cmcc-rax3000m-nand#mt7981b-cmcc-rax3000me-nousb
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootdelay=0
++bootfile=immortalwrt-mediatek-filogic-cmcc_rax3000me-initramfs-recovery.itb
++bootfile_bl2=immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-preloader.bin
++bootfile_fip=immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-bl31-uboot.fip
++bootfile_upg=immortalwrt-mediatek-filogic-cmcc_rax3000me-squashfs-sysupgrade.itb
++bootled_pwr=red:status
++bootled_rec=blue:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [SPI-NAND]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"

package/firmware/intel-microcode/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20240531
+PKG_VERSION:=20250211
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).1.tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/non-free-firmware/i/intel-microcode/
-PKG_HASH:=808cbb57a790dab7060b59b31e70e54ac47d3798d75e9784ed57a65b9f951fc4
+PKG_HASH:=06b7aca49790d673623cb42f7a62a517d82555ce96371d2967b568d6e30fd787
 PKG_BUILD_DIR:=$(BUILD_DIR)/intel-microcode-3.$(PKG_VERSION).1
 PKG_CPE_ID:=cpe:/a:intel:microcode
 

package/kernel/bcm27xx-gpu-fw/Makefile

@@ -2,13 +2,13 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=bcm27xx-gpu-fw
-PKG_VERSION:=2024.11.26
+PKG_VERSION:=2025.03.05
 PKG_VERSION_REAL:=1.$(subst .,,$(PKG_VERSION))
 PKG_RELEASE:=1
 
 PKG_SOURCE:=raspi-firmware_$(PKG_VERSION_REAL).orig.tar.xz
 PKG_SOURCE_URL:=https://github.com/raspberrypi/firmware/releases/download/$(PKG_VERSION_REAL)
-PKG_HASH:=020dbcdbb30af5942a62fc3eb355449aba45276b67e864dee2522ff53fd936e6
+PKG_HASH:=f697079cd15389c0d8650283eb911c53a64b22550138704eb50e1145e8330b03
 
 PKG_FLAGS:=nonshared
 

package/kernel/mac80211/patches/rt2x00/603-wifi-rt2x00-Add-support-for-loading-EEPROM-from-devicetree-embedded-data.patch

@@ -0,0 +1,76 @@
+From adf957124a115bdf3e4728e1ea8c70a632648cf0 Mon Sep 17 00:00:00 2001
+From: Coia Prant <coiaprant@gmail.com>
+Date: Fri, 14 Feb 2025 15:49:55 +0800
+Subject: [PATCH] wifi: rt2x00: Add support for loading EEPROM from devicetree
+ embedded data
+
+This patch allows rt2x00 to load eeprom from devicetree embedded data.
+
+Example:
+
+/* load eeprom from embedded data 'eeprom-data' */
+&wmac {
+	ralink,eeprom-data = <0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff>;
+};
+
+Signed-off-by: Coia Prant <coiaprant@gmail.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2x00eeprom.c | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+@@ -33,6 +33,27 @@ static void rt2800lib_eeprom_swap(struct
+ 		rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
+ }
+ 
++static int rt2800lib_read_eeprom_data(struct rt2x00_dev *rt2x00dev)
++{
++	struct device_node *np = rt2x00dev->dev->of_node;
++	unsigned int len = rt2x00dev->ops->eeprom_size;
++	const void *data;
++	int size;
++
++	data = of_get_property(np, "ralink,eeprom-data", &size);
++	if (!data)
++		return -ENOENT;
++
++	if (size != len) {
++		dev_err(rt2x00dev->dev, "invalid eeprom size, required: 0x%04x\n", len);
++		return -EINVAL;
++	}
++
++	memcpy(rt2x00dev->eeprom, data, size);
++
++	return 0;
++}
++
+ #if IS_ENABLED(CONFIG_MTD)
+ static int rt2800lib_read_eeprom_mtd(struct rt2x00_dev *rt2x00dev)
+ {
+@@ -193,6 +214,10 @@ int rt2x00lib_read_eeprom(struct rt2x00_
+ {
+ 	int ret;
+ 
++	ret = rt2800lib_read_eeprom_data(rt2x00dev);
++	if (!ret)
++		return 0;
++
+ #if IS_ENABLED(CONFIG_MTD)
+ 	ret = rt2800lib_read_eeprom_mtd(rt2x00dev);
+ 	if (!ret)

package/kernel/mwlwifi/Makefile

@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mwlwifi
-PKG_RELEASE=2
+PKG_RELEASE=1
 
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/kaloz/mwlwifi
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2024-04-19
-PKG_SOURCE_VERSION:=a737d348ef4fe00434b2bc44b2b6a68ea833d95b
-PKG_MIRROR_HASH:=d55f69c2fa48d02ba535b72b108fc77f5f13a52b29130a631489a053f1670d2c
+PKG_SOURCE_DATE:=2025-02-06
+PKG_SOURCE_VERSION:=db97edf20fadea2617805006f5230665fadc6a8c
+PKG_MIRROR_HASH:=b5464cf6d57d87f6ce5f13bd2320c7e7e671a3152a74f4ef004382f898b89ecf
 
 PKG_MAINTAINER:=Imre Kaloz <kaloz@openwrt.org>
 PKG_BUILD_PARALLEL:=1

package/kernel/mwlwifi/patches/001-Simplify-coredump-memcpy-in-mwl_fwcmd_get_fw_core_dump.patch

@@ -20,7 +20,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/hif/fwcmd.c
 +++ b/hif/fwcmd.c
-@@ -3622,11 +3622,7 @@ int mwl_fwcmd_get_fw_core_dump(struct ie
+@@ -3624,11 +3624,7 @@ int mwl_fwcmd_get_fw_core_dump(struct ie
  	core_dump->context = pcmd->cmd_data.coredump.context;
  	core_dump->size_kb = pcmd->cmd_data.coredump.size_kb;
  	core_dump->flags = pcmd->cmd_data.coredump.flags;

package/kernel/mwlwifi/patches/002-Correctly-use-PTR_ERR-in-pcie_bf_mimo_ctrl_decode.patch

@@ -19,7 +19,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/hif/pcie/pcie.c
 +++ b/hif/pcie/pcie.c
-@@ -1466,8 +1466,8 @@ static void pcie_bf_mimo_ctrl_decode(str
+@@ -1449,8 +1449,8 @@ static void pcie_bf_mimo_ctrl_decode(str
  			       &fp_data->f_pos);
  		filp_close(fp_data, current->files);
  	} else {

package/kernel/mwlwifi/patches/003-Use-zu-and-zd-for-ssize_t-and-size_t.patch

@@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/debugfs.c
 +++ b/debugfs.c
-@@ -1342,7 +1342,7 @@ done:
+@@ -1394,7 +1394,7 @@ done:
  				 priv->reg_value);
  	else
  		len += scnprintf(p + len, size - len,

package/kernel/mwlwifi/patches/010-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch

@@ -1,31 +0,0 @@
-From 8e809b241695252e397bf0d7fc5f36e115c38831 Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Fri, 5 Mar 2021 11:47:59 +0100
-Subject: [PATCH] mwlwifi: fix PCIe DT node null pointer dereference
-
-pci_bus_to_OF_node() used to get the PCI bus DT node
-returns node if found or NULL if none is found.
-
-Since the return of pci_bus_to_OF_node() is not checked in
-the DT node name print it will cause a null pointer
-dereference and crash the kernel.
-
-So first check whether the node is not NULL and then print.
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- hif/pcie/pcie.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/hif/pcie/pcie.c
-+++ b/hif/pcie/pcie.c
-@@ -685,7 +685,8 @@ static struct device_node *pcie_get_devi
- 	struct device_node *dev_node;
- 
- 	dev_node = pci_bus_to_OF_node(pcie_priv->pdev->bus);
--	wiphy_info(priv->hw->wiphy, "device node: %s\n", dev_node->full_name);
-+	if (dev_node)
-+		wiphy_info(priv->hw->wiphy, "device node: %s\n", dev_node->full_name);
- 
- 	return dev_node;
- }

package/kernel/mwlwifi/patches/020-mac80211_update.patch

@@ -13,7 +13,7 @@
  
 --- a/debugfs.c
 +++ b/debugfs.c
-@@ -498,9 +498,9 @@ static ssize_t mwl_debugfs_vif_read(stru
+@@ -550,9 +550,9 @@ static ssize_t mwl_debugfs_vif_read(stru
  		switch (vif->type) {
  		case NL80211_IFTYPE_AP:
  			len += scnprintf(p + len, size - len, "type: ap\n");
@@ -26,7 +26,7 @@
  			len += scnprintf(p + len, size - len,
  					 "ssid: %s\n", ssid);
  			len += scnprintf(p + len, size - len,
-@@ -522,8 +522,8 @@ static ssize_t mwl_debugfs_vif_read(stru
+@@ -574,8 +574,8 @@ static ssize_t mwl_debugfs_vif_read(stru
  					 "type: unknown\n");
  			break;
  		}
@@ -37,7 +37,7 @@
  			len += scnprintf(p + len, size - len,
  					 "channel: %d: width: %d\n",
  					 chan_def->chan->hw_value,
-@@ -596,18 +596,18 @@ static ssize_t mwl_debugfs_sta_read(stru
+@@ -648,18 +648,18 @@ static ssize_t mwl_debugfs_sta_read(stru
  			sta_info->wds ? "true" : "false",
  			sta_info->ba_hist.enable ? "enable" : "disable",
  			sta_info->is_amsdu_allowed ? sta_info->amsdu_ctrl.cap : 0 ,
@@ -68,7 +68,7 @@
  			sta->tdls,
  			sta->tdls_initiator,
  			sta->wme,
-@@ -1158,7 +1158,7 @@ static ssize_t mwl_debugfs_dfs_radar_wri
+@@ -1210,7 +1210,7 @@ static ssize_t mwl_debugfs_dfs_radar_wri
  	struct mwl_priv *priv = (struct mwl_priv *)file->private_data;
  
  	wiphy_info(priv->hw->wiphy, "simulate radar detected\n");
@@ -127,7 +127,7 @@
  			a_band = true;
  		else
  			return -EINVAL;
-@@ -2090,7 +2094,7 @@ int mwl_fwcmd_set_beacon(struct ieee8021
+@@ -2092,7 +2096,7 @@ int mwl_fwcmd_set_beacon(struct ieee8021
  	if (mwl_fwcmd_set_wsc_ie(hw, b_inf->ie_wsc_len, b_inf->ie_wsc_ptr))
  		goto err;
  
@@ -136,7 +136,7 @@
  		goto err;
  
  	if (b_inf->cap_info & WLAN_CAPABILITY_SPECTRUM_MGMT)
-@@ -2152,38 +2156,38 @@ int mwl_fwcmd_set_new_stn_add(struct iee
+@@ -2154,38 +2158,38 @@ int mwl_fwcmd_set_new_stn_add(struct iee
  	ether_addr_copy(pcmd->mac_addr, sta->addr);
  
  	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
@@ -189,7 +189,7 @@
  	}
  
  	pcmd->is_qos_sta = sta->wme;
-@@ -2239,38 +2243,38 @@ int mwl_fwcmd_set_new_stn_add_sc4(struct
+@@ -2241,38 +2245,38 @@ int mwl_fwcmd_set_new_stn_add_sc4(struct
  	ether_addr_copy(pcmd->mac_addr, sta->addr);
  
  	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
@@ -242,7 +242,7 @@
  	}
  
  	pcmd->is_qos_sta = sta->wme;
-@@ -2787,9 +2791,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+@@ -2789,9 +2793,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
  	pcmd->ba_info.create_params.flags = cpu_to_le32(ba_flags);
  	pcmd->ba_info.create_params.queue_id = stream->idx;
  	pcmd->ba_info.create_params.param_info =
@@ -254,7 +254,7 @@
  		 IEEE80211_HT_AMPDU_PARM_DENSITY);
  	if (direction == BA_FLAG_DIRECTION_UP) {
  		pcmd->ba_info.create_params.reset_seq_no = 0;
-@@ -2799,9 +2803,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+@@ -2801,9 +2805,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
  		pcmd->ba_info.create_params.current_seq = cpu_to_le16(0);
  	}
  	if (priv->chip_type == MWL8964 &&
@@ -268,16 +268,16 @@
  	}
 --- a/hif/pcie/8864/tx.c
 +++ b/hif/pcie/8864/tx.c
-@@ -490,7 +490,7 @@ static void pcie_non_pfu_tx_done(struct
- 				} else
- 					memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
- 				skb_pull(done_skb, sizeof(*dma_data) - hdrlen);
--				ieee80211_tx_status(priv->hw, done_skb);
-+				ieee80211_tx_status_skb(priv->hw, done_skb);
- 				dev_kfree_skb_any(done_skb);
- 				done_skb = NULL;
- 			}
-@@ -743,7 +743,7 @@ void pcie_8864_tx_xmit(struct ieee80211_
+@@ -478,7 +478,7 @@ static void pcie_non_pfu_tx_done(struct
+ 			} else
+ 				memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
+ 			skb_pull(done_skb, sizeof(*dma_data) - hdrlen);
+-			ieee80211_tx_status(priv->hw, done_skb);
++			ieee80211_tx_status_skb(priv->hw, done_skb);
+ next:
+ 			tx_hndl = tx_hndl->pnext;
+ 			tx_desc = tx_hndl->pdesc;
+@@ -730,7 +730,7 @@ void pcie_8864_tx_xmit(struct ieee80211_
  	index = SYSADPT_TX_WMM_QUEUES - index - 1;
  	txpriority = index;
  
@@ -286,7 +286,7 @@
  	  !(xmitcontrol & EAGLE_TXD_XMITCTRL_USE_MC_RATE) &&
  	    ieee80211_is_data_qos(wh->frame_control)) {
  		tid = qos & 0xf;
-@@ -925,4 +925,4 @@ void pcie_8864_tx_del_sta_amsdu_pkts(str
+@@ -912,4 +912,4 @@ void pcie_8864_tx_del_sta_amsdu_pkts(str
  		}
  	}
  	spin_unlock_bh(&sta_info->amsdu_lock);
@@ -313,7 +313,7 @@
  
  bypass_ack:
  		if (++tx_done_tail >= MAX_TX_RING_DONE_SIZE)
-@@ -596,13 +596,13 @@ void pcie_tx_xmit_ndp(struct ieee80211_h
+@@ -593,13 +593,13 @@ void pcie_tx_xmit_ndp(struct ieee80211_h
  			ack_skb = skb_copy(skb, GFP_ATOMIC);
  			ack_info = IEEE80211_SKB_CB(ack_skb);
  			pcie_tx_prepare_info(priv, 0, ack_info);
@@ -340,16 +340,16 @@
  		   pcie_priv->txbd_ring_size);
  
  	for (num = 0; num < PCIE_MAX_TXRX_BD; num++) {
-@@ -444,7 +444,7 @@ static void pcie_pfu_tx_done(struct mwl_
- 				} else
- 					memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
- 				skb_pull(done_skb, sizeof(*pfu_dma) - hdrlen);
--				ieee80211_tx_status(priv->hw, done_skb);
-+				ieee80211_tx_status_skb(priv->hw, done_skb);
- 			}
+@@ -431,7 +431,7 @@ static void pcie_pfu_tx_done(struct mwl_
+ 			} else
+ 				memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
+ 			skb_pull(done_skb, sizeof(*pfu_dma) - hdrlen);
+-			ieee80211_tx_status(priv->hw, done_skb);
++			ieee80211_tx_status_skb(priv->hw, done_skb);
  		}
  next:
-@@ -694,7 +694,7 @@ void pcie_8997_tx_xmit(struct ieee80211_
+ 		memset(data_buf, 0, sizeof(*data_buf));
+@@ -682,7 +682,7 @@ void pcie_8997_tx_xmit(struct ieee80211_
  	index = SYSADPT_TX_WMM_QUEUES - index - 1;
  	txpriority = index;
  
@@ -358,7 +358,7 @@
  	  !(xmitcontrol & EAGLE_TXD_XMITCTRL_USE_MC_RATE) &&
  	    ieee80211_is_data_qos(wh->frame_control)) {
  		tid = qos & 0xf;
-@@ -875,4 +875,4 @@ void pcie_8997_tx_del_sta_amsdu_pkts(str
+@@ -863,4 +863,4 @@ void pcie_8997_tx_del_sta_amsdu_pkts(str
  		}
  	}
  	spin_unlock_bh(&sta_info->amsdu_lock);
@@ -376,7 +376,7 @@
  {
  	mwl_fwcmd_radio_disable(hw);
  
-@@ -368,15 +368,15 @@ static void mwl_mac80211_bss_info_change
+@@ -390,15 +390,15 @@ static void mwl_mac80211_bss_info_change
  		}
  	}
  
@@ -395,7 +395,7 @@
  {
  	struct mwl_priv *priv = hw->priv;
  	struct mwl_vif *mwl_vif;
-@@ -426,8 +426,8 @@ static void mwl_mac80211_bss_info_change
+@@ -448,8 +448,8 @@ static void mwl_mac80211_bss_info_change
  	if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
  		struct sk_buff *skb;
  
@@ -406,7 +406,7 @@
  		    (!info->hidden_ssid)) {
  			if (mwl_vif->broadcast_ssid != true) {
  				mwl_fwcmd_broadcast_ssid_enable(hw, vif, true);
-@@ -441,7 +441,7 @@ static void mwl_mac80211_bss_info_change
+@@ -463,7 +463,7 @@ static void mwl_mac80211_bss_info_change
  		}
  
  		if (!mwl_vif->set_beacon) {
@@ -415,7 +415,7 @@
  
  			if (skb) {
  				mwl_fwcmd_set_beacon(hw, vif, skb->data, skb->len);
-@@ -458,7 +458,7 @@ static void mwl_mac80211_bss_info_change
+@@ -480,7 +480,7 @@ static void mwl_mac80211_bss_info_change
  static void mwl_mac80211_bss_info_changed(struct ieee80211_hw *hw,
  					  struct ieee80211_vif *vif,
  					  struct ieee80211_bss_conf *info,
@@ -424,7 +424,7 @@
  {
  	switch (vif->type) {
  	case NL80211_IFTYPE_AP:
-@@ -583,10 +583,10 @@ static int mwl_mac80211_sta_add(struct i
+@@ -605,10 +605,10 @@ static int mwl_mac80211_sta_add(struct i
  	if (vif->type == NL80211_IFTYPE_MESH_POINT)
  		sta_info->is_mesh_node = true;
  
@@ -437,7 +437,7 @@
  			sta_info->amsdu_ctrl.cap = MWL_AMSDU_SIZE_8K;
  			sta_info->amsdu_ctrl.amsdu_allow_size = SYSADPT_AMSDU_8K_MAX_SIZE;
  		}
-@@ -670,7 +670,7 @@ static int mwl_mac80211_sta_remove(struc
+@@ -692,7 +692,7 @@ static int mwl_mac80211_sta_remove(struc
  
  static int mwl_mac80211_conf_tx(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
@@ -446,7 +446,7 @@
  				const struct ieee80211_tx_queue_params *params)
  {
  	struct mwl_priv *priv = hw->priv;
-@@ -934,4 +934,9 @@ const struct ieee80211_ops mwl_mac80211_
+@@ -956,4 +956,9 @@ const struct ieee80211_ops mwl_mac80211_
  	.pre_channel_switch = mwl_mac80211_chnl_switch,
  	.sw_scan_start      = mwl_mac80211_sw_scan_start,
  	.sw_scan_complete   = mwl_mac80211_sw_scan_complete,
@@ -502,16 +502,7 @@
  	case TX_RATE_FORMAT_LEGACY:
 --- a/hif/pcie/pcie.c
 +++ b/hif/pcie/pcie.c
-@@ -546,7 +546,7 @@ static irqreturn_t pcie_isr_8864(struct
- 
- 		if (int_status & MACREG_A2HRIC_BIT_RADAR_DETECT) {
- 			wiphy_info(hw->wiphy, "radar detected by firmware\n");
--			ieee80211_radar_detected(hw);
-+			ieee80211_radar_detected(hw, NULL);
- 		}
- 
- 		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH) ieee80211_queue_work(hw, &priv->chnl_switch_handle);
-@@ -593,7 +593,7 @@ static irqreturn_t pcie_isr_8997(struct
+@@ -533,7 +533,7 @@ static irqreturn_t pcie_isr_8864(struct
  
  		if (int_status & MACREG_A2HRIC_BIT_RADAR_DETECT) {
  			wiphy_info(hw->wiphy, "radar detected by firmware\n");
@@ -520,7 +511,16 @@
  		}
  
  		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH)
-@@ -1071,7 +1071,7 @@ static irqreturn_t pcie_isr_ndp(struct i
+@@ -575,7 +575,7 @@ static irqreturn_t pcie_isr_8997(struct
+ 
+ 		if (int_status & MACREG_A2HRIC_BIT_RADAR_DETECT) {
+ 			wiphy_info(hw->wiphy, "radar detected by firmware\n");
+-			ieee80211_radar_detected(hw);
++			ieee80211_radar_detected(hw, NULL);
+ 		}
+ 
+ 		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH)
+@@ -1053,7 +1053,7 @@ static irqreturn_t pcie_isr_ndp(struct i
  
  		if (int_status & MACREG_A2HRIC_NEWDP_DFS) {
  			wiphy_info(hw->wiphy, "radar detected by firmware\n");

package/libs/libnl-tiny/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libnl-tiny.git
-PKG_SOURCE_DATE:=2023-12-05
-PKG_SOURCE_VERSION:=965c4bf49658342ced0bd6e7cb069571b4a1ddff
-PKG_MIRROR_HASH:=4b56499e71f5f10b123e1c7ee13dbfcd970de560bff8d16ab39dc25c9ff743cb
+PKG_SOURCE_DATE:=2025-03-19
+PKG_SOURCE_VERSION:=c0df580adbd4d555ecc1962dbe88e91d75b67a4e
+PKG_MIRROR_HASH:=1064a27824d99a93cbf8dbc808caf2cb277f1825b378ec6076d2ecfb8866a81f
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1

package/libs/libpcap/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libpcap
 PKG_VERSION:=1.10.5
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://www.tcpdump.org/release/
@@ -22,7 +22,11 @@ PKG_CPE_ID:=cpe:/a:tcpdump:libpcap
 
 PKG_ASLR_PIE_REGULAR:=1
 
-PKG_CONFIG_DEPENDS := CONFIG_PACKAGE_rpcapd
+PKG_CONFIG_DEPENDS := \
+	CONFIG_PACKAGE_rpcapd \
+	CONFIG_PCAP_HAS_USB \
+	CONFIG_PCAP_HAS_BT \
+	CONFIG_PCAP_HAS_NETFILTER
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk

package/libs/libpcap/patches/001-Add-support-for-Realtek-Ethertype-DSA-data.patch

@@ -0,0 +1,28 @@
+From fcb2cbc3a306afcf7785a60a74dbea431e609d76 Mon Sep 17 00:00:00 2001
+From: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+Date: Thu, 6 Jan 2022 15:51:54 -0300
+Subject: [PATCH 1/2] Add support for Realtek (Ethertype) DSA data
+
+Realtek switchtag rtl4a (4 bytes long, protocol 0xA) and rtl8_4 (8 bytes
+long, protocol 0x04) are Ethertype DSA tags, inserted in the Ethernet
+header similar to an 802.1Q tag. Both shares the same Ethertype 0x8899
+as other Realtek proprietary protocols.
+
+Realtek switchtag rtl8_4t is identical to rtl8_4 but positioned before
+the CRC, at the end of the Ethernet frame.
+---
+ pcap-linux.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -5281,6 +5281,9 @@ static struct dsa_proto {
+ 	{ "brcm-prepend", DLT_DSA_TAG_BRCM_PREPEND },
+ 	{ "dsa", DLT_DSA_TAG_DSA },
+ 	{ "edsa", DLT_DSA_TAG_EDSA },
++	{ "rtl4a", DLT_EN10MB },
++	{ "rtl8_4", DLT_EN10MB },
++	{ "rtl8_4t", DLT_EN10MB },
+ };
+ 
+ static int

package/libs/libpcap/patches/002-Linux-handle-other-DSA-tags.patch

@@ -0,0 +1,322 @@
+From 7d298976beff0cce310fb53a430f82b53f43a394 Mon Sep 17 00:00:00 2001
+From: Guy Harris <gharris@sonic.net>
+Date: Fri, 14 Feb 2025 19:12:24 -0800
+Subject: [PATCH 2/2] Linux: handle other DSA tags.
+
+Many of those entries need their own LINKTYPE_/DLT_? values, including
+tcpdump and Wireshark support for same, but at least this lets you see
+raw hex data from a capture.
+
+Fixes #1367.
+
+Supercedes #1451.
+---
+ pcap-linux.c | 284 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 280 insertions(+), 4 deletions(-)
+
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -5267,23 +5267,299 @@ iface_get_offload(pcap_t *handle _U_)
+ }
+ #endif /* SIOCETHTOOL */
+ 
++/*
++ * As per
++ *
++ *    https://www.kernel.org/doc/html/latest/networking/dsa/dsa.html#switch-tagging-protocols
++ *
++ * Type 1 means that the tag is prepended to the Ethernet packet.
++ * LINKTYPE_ETHERNET/DLT_EN10MB doesn't work, as it would try to
++ * dissect the tag data as the Ethernet header.  These should get
++ * their own LINKTYPE_DLT_ values.
++ *
++ * Type 2 means that the tag is inserted into the Ethernet header
++ * after the source address and before the type/length field.
++ *
++ * Type 3 means that tag is a packet trailer.  LINKTYPE_ETHERNET/DLT_EN10MB
++ * works,  unless the next-layer protocol has no length field of its own,
++ * so that the tag might be treated as part of the payload. These should
++ * get their own LINKTYPE_/DLT_ values.
++ *
++ * If you get an "unsupported DSA tag" error, please add the tag to here,
++ * complete with a full comment indicating whether it's type 1, 2, or 3,
++ * and, for type 2, indicating whether it has an Ethertype and, if so
++ * what that type is, and whether it's registered with the IEEE or is
++ * self-assigned. Also, point to *something* that indicates the format
++ * of the tag.
++ */
+ static struct dsa_proto {
+ 	const char *name;
+ 	bpf_u_int32 linktype;
+ } dsa_protos[] = {
+ 	/*
+-	 * None is special and indicates that the interface does not have
+-	 * any tagging protocol configured, and is therefore a standard
+-	 * Ethernet interface.
++	 * Type 1. See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ar9331.c
++	 */
++	{ "ar9331", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Ethertype at the beginning,
++	 * assigned a LINKTYPE_/DLT_ value.
+ 	 */
+-	{ "none", DLT_EN10MB },
+ 	{ "brcm", DLT_DSA_TAG_BRCM },
++
++	/*
++	 * Type 2, with Ethertype 0x8874, assigned to Broadcom.
++	 *
++	 * This doies not require a LINKTYPE_/DLT_ value, it
++	 * just requires that Ethertype 0x8874 be dissected
++	 * properly.
++	 */
++	{ "brcm-legacy", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 */
+ 	{ "brcm-prepend", DLT_DSA_TAG_BRCM_PREPEND },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * assigned a LINKTYPE_/DLT_ value.
++	 */
+ 	{ "dsa", DLT_DSA_TAG_DSA },
++
++	/*
++	 * Type 2, with an Ethertype field, but without
++	 * an assigned Ethertype value that can be relied
++	 * on; assigned a LINKTYPE_/DLT_ value.
++	 */
+ 	{ "edsa", DLT_DSA_TAG_EDSA },
++
++	/*
++	 * Type 1, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_gswip.c
++	 */
++	{ "gswip", DLT_EN10MB },
++
++	/*
++	 * Type 3. See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_hellcreek.c
++	 */
++	{ "hellcreek", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L102
++	 */
++	{ "ksz8795", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L160
++	 */
++	{ "ksz9477", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L341
++	 */
++	{ "ksz9893", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L386
++	 */
++	{ "lan937x", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_lan9303.c#L24
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "lan9303", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * should be assigned a LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_mtk.c#L15
++	 */
++	{ "mtk", DLT_EN10MB },
++
++	/*
++	 * None is special and indicates that the interface does not have
++	 * any tagging protocol configured, and is therefore a standard
++	 * Ethernet interface.
++	 */
++	{ "none", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
++	 */
++	{ "ocelot", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
++	 */
++	{ "seville", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "ocelot-8021q", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * should be assigned a LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_qca.c
++	 */
++	{ "qca", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8899, assigned to Realtek;
++	 * they use it for several on-the-Ethernet protocols
++	 * as well, but there are fields that allow the two
++	 * tag formats, and all the protocols in question,
++	 * to be distinguiished from one another.
++	 *
++	 * This doies not require a LINKTYPE_/DLT_ value, it
++	 * just requires that Ethertype 0x8899 be dissected
++	 * properly.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rtl4_a.c
++	 *
++	 *    http://realtek.info/pdf/rtl8306sd%28m%29_datasheet_1.1.pdf
++	 *
++	 * and various pages in tcpdump's print-realtek.c and Wireshark's
++	 * epan/dissectors/packet-realtek.c for the other protocols.
++	 */
+ 	{ "rtl4a", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8899, assigned to Realtek;
++	 * see above.
++	 */
+ 	{ "rtl8_4", DLT_EN10MB },
++
++	/*
++	 * Type 3, with the same tag format as rtl8_4.
++	 */
+ 	{ "rtl8_4t", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0xe001; that's probably
++	 * self-assigned, so this really should ahve its
++	 * own LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rzn1_a5psw.c
++	 */
++	{ "a5psw", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100 or the self-assigned
++	 * 0xdadb, so this really should ahve its own
++	 * LINKTYPE_/DLT_ value; that would also allow the
++	 * VID of the tag to be dissected as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 */
++	{ "sja1105", DLT_EN10MB },
++
++	/*
++	 * Type "none of the above", with both a header and trailer,
++	 * with different transmit and receive tags.  Has
++	 * Ethertype 0xdadc, which is probably self-assigned.
++	 * This should really have its own LINKTYPE_/DLT_ value.
++	 */
++	{ "sja1110", DLT_EN10MB },
++
++	/*
++	 * Type 3, as the name suggests.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_trailer.c
++	 */
++	{ "trailer", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "vsc73xx-8021q", DLT_EN10MB },
++
++	/*
++	 * Type 3.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_xrs700x.c
++	 */
++	{ "xrs700x", DLT_EN10MB },
+ };
+ 
+ static int

package/network/services/dnsmasq/files/dnsmasq.init

@@ -226,6 +226,14 @@ append_interface_name() {
 	xappend "--interface-name=$1,$2"
 }
 
+append_filter_rr() {
+	xappend "--filter-rr=$1"
+}
+
+append_cache_rr() {
+	xappend "--cache-rr=$1"
+}
+
 filter_dnsmasq() {
 	local cfg="$1" func="$2" match_cfg="$3" found_cfg
 
@@ -1000,8 +1008,8 @@ dnsmasq_start()
 	# deprecate or remove filter-X in favor of filter-rr?
 	append_bool "$cfg" filter_aaaa "--filter-AAAA"
 	append_bool "$cfg" filter_a "--filter-A"
-	append_parm "$cfg" filter_rr "--filter-rr"
-	append_parm "$cfg" cache_rr "--cache-rr"
+	config_list_foreach "$cfg" filter_rr append_filter_rr
+	config_list_foreach "$cfg" cache_rr append_cache_rr
 
 	append_parm "$cfg" logfacility "--log-facility"
 	config_get logfacility "$cfg" "logfacility"

package/network/services/hostapd/src/src/ap/ucode.c

@@ -23,7 +23,7 @@ hostapd_ucode_bss_get_uval(struct hostapd_data *hapd)
 	uc_value_t *val;
 
 	if (hapd->ucode.idx)
-		return wpa_ucode_registry_get(bss_registry, hapd->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(bss_registry, hapd->ucode.idx));
 
 	val = uc_resource_new(bss_type, hapd);
 	hapd->ucode.idx = wpa_ucode_registry_add(bss_registry, val);
@@ -37,7 +37,7 @@ hostapd_ucode_iface_get_uval(struct hostapd_iface *hapd)
 	uc_value_t *val;
 
 	if (hapd->ucode.idx)
-		return wpa_ucode_registry_get(iface_registry, hapd->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(iface_registry, hapd->ucode.idx));
 
 	val = uc_resource_new(iface_type, hapd);
 	hapd->ucode.idx = wpa_ucode_registry_add(iface_registry, val);
@@ -54,12 +54,11 @@ hostapd_ucode_update_bss_list(struct hostapd_iface *iface, uc_value_t *if_bss, u
 	list = ucv_array_new(vm);
 	for (i = 0; iface->bss && i < iface->num_bss; i++) {
 		struct hostapd_data *hapd = iface->bss[i];
-		uc_value_t *val = hostapd_ucode_bss_get_uval(hapd);
 
-		ucv_array_set(list, i, ucv_get(ucv_string_new(hapd->conf->iface)));
-		ucv_object_add(bss, hapd->conf->iface, ucv_get(val));
+		ucv_array_set(list, i, ucv_string_new(hapd->conf->iface));
+		ucv_object_add(bss, hapd->conf->iface, hostapd_ucode_bss_get_uval(hapd));
 	}
-	ucv_object_add(if_bss, iface->phy, ucv_get(list));
+	ucv_object_add(if_bss, iface->phy, list);
 }
 
 static void
@@ -73,13 +72,14 @@ hostapd_ucode_update_interfaces(void)
 	for (i = 0; i < interfaces->count; i++) {
 		struct hostapd_iface *iface = interfaces->iface[i];
 
-		ucv_object_add(ifs, iface->phy, ucv_get(hostapd_ucode_iface_get_uval(iface)));
+		ucv_object_add(ifs, iface->phy, hostapd_ucode_iface_get_uval(iface));
 		hostapd_ucode_update_bss_list(iface, if_bss, bss);
 	}
 
-	ucv_object_add(ucv_prototype_get(global), "interfaces", ucv_get(ifs));
-	ucv_object_add(ucv_prototype_get(global), "interface_bss", ucv_get(if_bss));
-	ucv_object_add(ucv_prototype_get(global), "bss", ucv_get(bss));
+	ucv_object_add(ucv_prototype_get(global), "interfaces", ifs);
+	ucv_object_add(ucv_prototype_get(global), "interface_bss", if_bss);
+	ucv_object_add(ucv_prototype_get(global), "bss", bss);
+
 	ucv_gc(vm);
 }
 
@@ -362,6 +362,10 @@ uc_hostapd_iface_add_bss(uc_vm_t *vm, size_t nargs)
 
 	hapd->driver = iface->bss[0]->driver;
 	hapd->drv_priv = iface->bss[0]->drv_priv;
+#ifdef CONFIG_IEEE80211BE
+	os_strlcpy(hapd->ctrl_sock_iface, hapd->conf->iface,
+		   sizeof(hapd->ctrl_sock_iface));
+#endif
 	if (interfaces->ctrl_iface_init &&
 	    interfaces->ctrl_iface_init(hapd) < 0)
 		goto free_hapd;
@@ -721,11 +725,10 @@ int hostapd_ucode_sta_auth(struct hostapd_data *hapd, struct sta_info *sta)
 	if (wpa_ucode_call_prepare("sta_auth"))
 		return 0;
 
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 
 	snprintf(addr, sizeof(addr), MACSTR, MAC2STR(sta->addr));
-	val = ucv_string_new(addr);
-	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_string_new(addr));
 
 	val = wpa_ucode_call(2);
 
@@ -787,16 +790,15 @@ void hostapd_ucode_sta_connected(struct hostapd_data *hapd, struct sta_info *sta
 	if (wpa_ucode_call_prepare("sta_connected"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 
 	snprintf(addr, sizeof(addr), MACSTR, MAC2STR(sta->addr));
-	val = ucv_string_new(addr);
-	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_string_new(addr));
 
 	val = ucv_object_new(vm);
 	if (sta->psk_idx)
 		ucv_object_add(val, "psk_idx", ucv_int64_new(sta->psk_idx - 1));
-	uc_value_push(ucv_get(val));
+	uc_value_push(val);
 
 	val = wpa_ucode_call(3);
 	if (ucv_type(val) != UC_OBJECT)
@@ -878,7 +880,7 @@ void hostapd_ucode_free(void)
 
 void hostapd_ucode_free_iface(struct hostapd_iface *iface)
 {
-	wpa_ucode_registry_remove(iface_registry, iface->ucode.idx);
+	ucv_put(wpa_ucode_registry_remove(iface_registry, iface->ucode.idx));
 }
 
 void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
@@ -889,10 +891,11 @@ void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->iface->phy)));
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->iface->phy));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(3));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -911,6 +914,8 @@ void hostapd_ucode_free_bss(struct hostapd_data *hapd)
 	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
+
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -923,10 +928,11 @@ void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname)
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface))); // BSS ifname
+	uc_value_push(ucv_string_new(hapd->conf->iface)); // BSS ifname
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(ifname))); // APuP peer ifname
+	uc_value_push(ucv_string_new(ifname)); // APuP peer ifname
 	ucv_put(wpa_ucode_call(2));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 #endif // def CONFIG_APUP

package/network/services/hostapd/src/src/utils/ucode.c

@@ -171,7 +171,7 @@ uc_value_t *uc_wpa_freq_info(uc_vm_t *vm, size_t nargs)
 	ucv_object_add(ret, "op_class", ucv_int64_new(op_class));
 	ucv_object_add(ret, "channel", ucv_int64_new(channel));
 	ucv_object_add(ret, "hw_mode", ucv_int64_new(hw_mode));
-	ucv_object_add(ret, "hw_mode_str", ucv_get(ucv_string_new(modestr)));
+	ucv_object_add(ret, "hw_mode_str", ucv_string_new(modestr));
 	ucv_object_add(ret, "sec_channel", ucv_int64_new(sec_channel));
 	ucv_object_add(ret, "frequency", ucv_int64_new(freq_val));
 
@@ -425,7 +425,7 @@ uc_value_t *wpa_ucode_global_init(const char *name, uc_resource_type_t *global_t
 
 	uc_vm_registry_set(&vm, "hostap.global", global);
 	proto = ucv_prototype_get(global);
-	ucv_object_add(proto, "data", ucv_get(ucv_object_new(&vm)));
+	ucv_object_add(proto, "data", ucv_object_new(&vm));
 
 #define ADD_CONST(x) ucv_object_add(proto, #x, ucv_int64_new(x))
 	ADD_CONST(MSG_EXCESSIVE);
@@ -470,6 +470,7 @@ uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx)
 	if (!val)
 		return NULL;
 
+	ucv_get(val);
 	ucv_array_set(reg, idx - 1, NULL);
 	dataptr = ucv_resource_dataptr(val, NULL);
 	if (dataptr)

package/network/services/hostapd/src/wpa_supplicant/ucode.c

@@ -20,7 +20,7 @@ wpas_ucode_iface_get_uval(struct wpa_supplicant *wpa_s)
 	uc_value_t *val;
 
 	if (wpa_s->ucode.idx)
-		return wpa_ucode_registry_get(iface_registry, wpa_s->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(iface_registry, wpa_s->ucode.idx));
 
 	val = uc_resource_new(iface_type, wpa_s);
 	wpa_s->ucode.idx = wpa_ucode_registry_add(iface_registry, val);
@@ -36,9 +36,9 @@ wpas_ucode_update_interfaces(void)
 	int i;
 
 	for (wpa_s = wpa_global->ifaces; wpa_s; wpa_s = wpa_s->next)
-		ucv_object_add(ifs, wpa_s->ifname, ucv_get(wpas_ucode_iface_get_uval(wpa_s)));
+		ucv_object_add(ifs, wpa_s->ifname, wpas_ucode_iface_get_uval(wpa_s));
 
-	ucv_object_add(ucv_prototype_get(global), "interfaces", ucv_get(ifs));
+	ucv_object_add(ucv_prototype_get(global), "interfaces", ifs);
 	ucv_gc(vm);
 }
 
@@ -49,8 +49,8 @@ void wpas_ucode_add_bss(struct wpa_supplicant *wpa_s)
 	if (wpa_ucode_call_prepare("iface_add"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
-	uc_value_push(ucv_get(wpas_ucode_iface_get_uval(wpa_s)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
+	uc_value_push(wpas_ucode_iface_get_uval(wpa_s));
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
@@ -67,9 +67,10 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s)
 	if (wpa_ucode_call_prepare("iface_remove"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -86,9 +87,9 @@ void wpas_ucode_update_state(struct wpa_supplicant *wpa_s)
 		return;
 
 	state = wpa_supplicant_state_txt(wpa_s->wpa_state);
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(state)));
+	uc_value_push(ucv_string_new(state));
 	ucv_put(wpa_ucode_call(3));
 	ucv_gc(vm);
 }
@@ -108,9 +109,9 @@ void wpas_ucode_event(struct wpa_supplicant *wpa_s, int event, union wpa_event_d
 	if (wpa_ucode_call_prepare("event"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(event_to_string(event))));
+	uc_value_push(ucv_string_new(event_to_string(event)));
 	val = ucv_object_new(vm);
 	uc_value_push(ucv_get(val));
 
@@ -212,15 +213,14 @@ uc_wpas_iface_status(uc_vm_t *vm, size_t nargs)
 {
 	struct wpa_supplicant *wpa_s = uc_fn_thisval("wpas.iface");
 	struct wpa_bss *bss;
-	uc_value_t *ret, *val;
+	uc_value_t *ret;
 
 	if (!wpa_s)
 		return NULL;
 
 	ret = ucv_object_new(vm);
 
-	val = ucv_string_new(wpa_supplicant_state_txt(wpa_s->wpa_state));
-	ucv_object_add(ret, "state", ucv_get(val));
+	ucv_object_add(ret, "state", ucv_string_new(wpa_supplicant_state_txt(wpa_s->wpa_state)));
 
 	bss = wpa_s->current_bss;
 	if (bss) {

package/network/services/lldpd/files/lldpd.init

@@ -75,9 +75,9 @@ get_config_restart_hash() {
 	export -n "$var=$_hash"
 }
 
-get_config_cid_ifaces() {
+get_interface_csv() {
 	local _ifaces
-	config_get _ifaces 'config' "$2"
+	config_get _ifaces "$2" "$3"
 
 	local _iface _ifnames=""
 	# Set noglob to prevent '*' capturing diverse file names in the for ... in
@@ -98,6 +98,21 @@ get_config_cid_ifaces() {
 	export -n "${1}=$_ifnames"
 }
 
+add_custom_tlv_callback()
+{
+	# syntax: configure [ports ethX[,…]] lldp custom-tlv [add|replace] oui XX,XX,XX subtype XX oui-info XX[,XX,...]
+	# ex: configure ports br-lan,eth0 lldp custom-tlv replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55
+	# ex: configure lldp custom-tlv oui 33,44,44 subtype 232
+
+	local _ports
+	local _tlv
+	# CSV of device ports
+	get_interface_csv _ports "$1" 'ports'
+	config_get _tlv "$1" 'tlv'
+
+	echo "configure ${_ports:+ports $_ports }lldp custom-tlv $_tlv" >> "$LLDPD_CONF"
+}
+
 write_lldpd_conf()
 {
 	local lldp_description
@@ -109,7 +124,7 @@ write_lldpd_conf()
 	config_get lldp_hostname 'config' 'lldp_hostname' "$(cat /proc/sys/kernel/hostname)"
 
 	local ifnames
-	get_config_cid_ifaces ifnames "interface"
+	get_interface_csv ifnames 'config' "interface"
 
 	local lldp_mgmt_ip
 	config_get lldp_mgmt_ip 'config' 'lldp_mgmt_ip'
@@ -197,6 +212,9 @@ write_lldpd_conf()
 	[ "$lldp_mgmt_addr_advertisements" -gt 0 ] && echo "configure lldp management-addresses-advertisements" >> "$LLDPD_CONF" ||\
 		echo "unconfigure lldp management-addresses-advertisements" >> "$LLDPD_CONF"
 
+	# Custom TLV handling
+	config_foreach add_custom_tlv_callback 'custom-tlv'
+
 	# Since lldpd's sysconfdir is /tmp, we'll symlink /etc/lldpd.d to /tmp/$LLDPD_CONFS_DIR
 	[ -e "$LLDPD_CONFS_DIR" ] || ln -s /etc/lldpd.d "$LLDPD_CONFS_DIR"
 }
@@ -335,7 +353,7 @@ start_service() {
 
     # ChassisID interfaces
 	local ifnames
-	get_config_cid_ifaces ifnames "cid_interface"
+	get_interface_csv ifnames 'config' "cid_interface"
 
 	[ -n "$ifnames" ] && procd_append_param command -C "$ifnames"
 

package/network/services/unetd/Makefile

@@ -10,9 +10,9 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=unetd
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/unetd.git
-PKG_SOURCE_DATE:=2025-01-29
-PKG_SOURCE_VERSION:=082b5482b97f20dc4745bc3d645e33b584cc28e4
-PKG_MIRROR_HASH:=090e7dab3b9a3358706dcee4f1889b7a1f0bdf535f2d6a0580f4160e23ccf9cb
+PKG_SOURCE_DATE:=2025-03-09
+PKG_SOURCE_VERSION:=6c9c8fbd81285a2cba7dd1c2c1ac2bf25ca99e27
+PKG_MIRROR_HASH:=9dc06c945713a6a289ed0838ebe59e65b4fbb333e02d5159a8e87d29754808a6
 
 PKG_LICENSE:=GPL-2.0
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
@@ -32,7 +32,7 @@ define Package/unetd
   SECTION:=net
   CATEGORY:=Network
   TITLE:=WireGuard based VPN connection manager for OpenWrt
-  DEPENDS:=+libubox +libubus +libblobmsg-json +libnl-tiny +kmod-wireguard +UNETD_VXLAN_SUPPORT:libbpf
+  DEPENDS:=+libubox +libubus +libudebug +libblobmsg-json +libnl-tiny +kmod-wireguard +UNETD_VXLAN_SUPPORT:libbpf
 endef
 
 define Package/unetd/config

package/network/utils/ethtool/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ethtool
-PKG_VERSION:=6.10
+PKG_VERSION:=6.11
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
-PKG_HASH:=cc613fe8a2bcddee17a1e6e0d763c0f3ea33c7e930658d2d7f601aa65e426a1f
+PKG_HASH:=8d91f5c72ae3f25b7e88d4781279dcb320f71e30058914370b1c574c96b31202
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
@@ -57,6 +57,11 @@ else
 CONFIGURE_ARGS += --disable-netlink --disable-pretty-dump
 endif
 
+# enable support for input_xfrm with kernels newer than 6.6
+ifeq ($(CONFIG_LINUX_6_6),)
+CONFIGURE_ARGS += --enable-rss-input-xfrm
+endif
+
 define Package/ethtool/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ethtool $(1)/usr/sbin

package/network/utils/ethtool/patches/0001-ethtool-make-building-for-RSS-input-xfrm-optional.patch

@@ -0,0 +1,67 @@
+From c88eb6f4e9b2d8f71f3391db2bf0ec82ecccae81 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 12 Feb 2025 04:12:42 +0000
+Subject: [PATCH] ethtool: make building for RSS input xfrm optional
+
+Unfortunately there is no way to detect at runtime if the kernel the
+support for RSS input transformation, and the default value
+RXH_XFRM_NO_CHANGE (0xff) used by newer ethtool results in breakage
+with older kernels.
+As a stop-gap solution simply don't compile with support for input
+xfrm by default.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ configure.ac | 10 ++++++++++
+ ethtool.c    | 10 ++++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -45,6 +45,16 @@ if test x$enable_pretty_dump = xyes; the
+ fi
+ AM_CONDITIONAL([ETHTOOL_ENABLE_PRETTY_DUMP], [test x$enable_pretty_dump = xyes])
+ 
++AC_ARG_ENABLE(rss-input-xfrm,
++	      [  --enable-rss-input-xfrm  build with support for RSS input transformation (disabled by default)],
++	      ,
++	      enable_rss_input_xfrm=no)
++if test x$enable_rss_input_xfrm = xyes; then
++    AC_DEFINE(ETHTOOL_ENABLE_RSS_INPUT_XFRM, 1,
++	      [Define this to enable building with support for RSS input transformation.])
++fi
++AM_CONDITIONAL([ETHTOOL_ENABLE_RSS_INPUT_XFRM], [test x$enable_rss_input_xfrm = xyes])
++
+ AC_ARG_WITH([bash-completion-dir],
+ 	    AS_HELP_STRING([--with-bash-completion-dir[=PATH]],
+ 	                   [Install the bash-completion script in this directory. @<:@default=yes@:>@]),
+--- a/ethtool.c
++++ b/ethtool.c
+@@ -4109,9 +4109,11 @@ static int do_grxfh(struct cmd_context *
+ 		       (const char *)hfuncs->data + i * ETH_GSTRING_LEN,
+ 		       (rss->hfunc & (1 << i)) ? "on" : "off");
+ 
++#ifdef ETHTOOL_ENABLE_RSS_INPUT_XFRM
+ 	printf("RSS input transformation:\n");
+ 	printf("    symmetric-xor: %s\n",
+ 	       (rss->input_xfrm & RXH_XFRM_SYM_XOR) ? "on" : "off");
++#endif
+ 
+ out:
+ 	free(hfuncs);
+@@ -4431,7 +4433,15 @@ static int do_srxfh(struct cmd_context *
+ 	rss->cmd = ETHTOOL_SRSSH;
+ 	rss->rss_context = rss_context;
+ 	rss->hfunc = req_hfunc;
++#ifdef ETHTOOL_ENABLE_RSS_INPUT_XFRM
+ 	rss->input_xfrm = req_input_xfrm;
++#else
++	if (req_input_xfrm != 0xff) {
++		perror("Compiled for kernel without support for input transformation");
++		err = 1;
++		goto free;
++	}
++#endif
+ 	if (delete) {
+ 		rss->indir_size = rss->key_size = 0;
+ 	} else {

package/utils/bcm27xx-utils/Makefile

@@ -3,13 +3,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bcm27xx-utils
-PKG_VERSION:=2024.12.19
+PKG_VERSION:=2025.03.14
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/raspberrypi/utils.git
-PKG_SOURCE_VERSION:=0c02957911da1c661be201236c4f2a2be1778b3e
-PKG_MIRROR_HASH:=8bc87c929726a13d3d3e16157033d13f78a1f85d548db131c45c3a4cbdd1e402
+PKG_SOURCE_VERSION:=685afa8c0d6f2310eaefe1b528627a8bf3154ca0
+PKG_MIRROR_HASH:=04528742fc5b55ba31f448a27588a9df707cbcc27823c1d219b7f877dd4ac200
 
 PKG_FLAGS:=nonshared
 PKG_BUILD_FLAGS:=no-lto

scripts/feeds

@@ -157,12 +157,12 @@ my %update_method = (
 	'src-git' => {
 		'init'          => "git clone --depth 1 '%s' '%s'",
 		'init_branch'   => "git clone --depth 1 --branch '%s' '%s' '%s'",
-		'init_commit'   => "git clone '%s' '%s' && cd '%s' && git checkout -b '%s' '%s' && cd -",
+		'init_commit'   => "git clone --depth 1 '%s' '%s' && cd '%s' && git fetch --depth=1 origin '%s' && git -c advice.detachedHead=false checkout '%s' && cd -",
 		'update'	=> "git pull --ff-only",
 		'update_rebase'	=> "git pull --rebase=merges",
 		'update_stash'	=> "git pull --rebase=merges --autostash",
 		'update_force'	=> "git pull --ff-only || (git reset --hard HEAD; git pull --ff-only; exit 1)",
-		'post_update'	=> "git submodule update --init --recursive",
+		'post_update'	=> "git submodule update --init --recursive --depth 1",
 		'controldir'	=> ".git",
 		'revision'	=> "git rev-parse HEAD | tr -d '\n'"},
 	'src-git-full' => {

target/linux/airoha/patches-6.6/029-v6.12-net-dsa-mt7530-Add-EN7581-support.patch

@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
-@@ -2783,6 +2788,28 @@ static void mt7988_mac_port_get_caps(str
+@@ -2779,6 +2784,28 @@ static void mt7988_mac_port_get_caps(str
  	}
  }
  
@@ -108,7 +108,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void
  mt7530_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
-@@ -3220,6 +3247,16 @@ const struct mt753x_info mt753x_table[]
+@@ -3216,6 +3243,16 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
  		.mac_port_get_caps = mt7988_mac_port_get_caps,
  	},

target/linux/ath79/dts/qca9563_zte_e8820.dts

@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "qca956x.dtsi"
+
+/ {
+	model = "ZTE E8820";
+	compatible = "zte,e8820", "qca,qca9563";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &power_green;
+		led-failsafe = &power_green;
+		led-running = &power_green;
+		led-upgrade = &power_green;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&jtag_disable_pins>;
+
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <2>;
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&hub_port0>;
+			linux,default-trigger = "usbport";
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <1>;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			trigger-sources = <&hub_port1>;
+			linux,default-trigger = "usbport";
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		power_green: led-4 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		button-wifi {
+			label = "wifi";
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+		};
+
+		button-wps {
+			label = "wps";
+			gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&eth0 {
+	nvmem-cells = <&macaddr_art_0 0>;
+	nvmem-cell-names = "mac-address";
+	
+	phy-handle = <&phy0>;
+	phy-mode = "sgmii";
+	pll-data = <0x03000101 0x00000101 0x00001919>;
+
+	status = "okay";
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+
+		qca,ar8327-initvals = <
+			0x04 0x00000080 /* PORT0 PAD MODE CTRL */
+			0x50 0xcc35cc35 /* LED_CTRL0 */
+			0x54 0xca35ca35 /* LED_CTRL1 */
+			0x58 0xc935c935 /* LED_CTRL2 */
+			0x5c 0x03ffff00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+		>;
+	};
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,003c";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&cal_art_5000>, <&macaddr_art_0 1>;
+		nvmem-cell-names = "calibration", "mac-address";
+	};
+};
+
+&spi {
+	num-cs = <1>;
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x050000 0xfa0000>;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_art_0: macaddr@0 {
+						compatible = "mac-base";
+						reg = <0x0 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					cal_art_1000: cal@1000 {
+						reg = <0x1000 0x440>;
+					};
+
+					cal_art_5000: cal@5000 {
+						reg = <0x5000 0x844>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&cal_art_1000>, <&macaddr_art_0 0>;
+	nvmem-cell-names = "calibration", "mac-address";
+	status = "okay";
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
+&usb1 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	status = "okay";
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};

target/linux/ath79/generic/base-files/etc/board.d/02_network

@@ -341,7 +341,8 @@ ath79_setup_interfaces()
 	sitecom,wlr-7100|\
 	tplink,archer-c2-v3|\
 	tplink,tl-wr1043nd-v4|\
-	tplink,tl-wr1043n-v5)
+	tplink,tl-wr1043n-v5|\
+	zte,e8820)
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "5:wan"
 		;;
@@ -868,6 +869,11 @@ ath79_setup_macs()
 	xiaomi,aiot-ac2350)
 		lan_mac=$(mtd_get_mac_binary art 0x1002)
 		;;
+	zte,e8820)
+		wan_mac=$(mtd_get_mac_binary art 0)
+		lan_mac=$(macaddr_add "$wan_mac" 1)
+		label_mac=$wan_mac
+                ;;
 	zyxel,nbg6616)
 		label_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		;;

target/linux/ath79/image/generic.mk

@@ -3357,6 +3357,15 @@ define Device/zbtlink_zbt-wd323
 endef
 TARGET_DEVICES += zbtlink_zbt-wd323
 
+define Device/zte_e8820
+  SOC := qca9563
+  DEVICE_VENDOR := ZTE
+  DEVICE_MODEL := E8820
+  IMAGE_SIZE := 16000k
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct
+endef
+TARGET_DEVICES += zte_e8820
+
 define Device/zyxel_nwa11xx
   $(Device/loader-okli-uimage)
   SOC := ar9342

target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch

@@ -751,7 +751,7 @@ SVN-Revision: 35130
  EXPORT_SYMBOL(xfrm_parse_spi);
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -4262,14 +4262,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -4268,14 +4268,16 @@ static bool tcp_parse_aligned_timestamp(
  {
  	const __be32 *ptr = (const __be32 *)(th + 1);
  
@@ -858,7 +858,7 @@ SVN-Revision: 35130
  
 --- a/net/ipv4/tcp_offload.c
 +++ b/net/ipv4/tcp_offload.c
-@@ -63,7 +63,7 @@ static struct sk_buff *__tcpv4_gso_segme
+@@ -66,7 +66,7 @@ static struct sk_buff *__tcpv4_gso_segme
  	th2 = tcp_hdr(seg->next);
  	iph2 = ip_hdr(seg->next);
  
@@ -867,7 +867,7 @@ SVN-Revision: 35130
  	    iph->daddr == iph2->daddr && iph->saddr == iph2->saddr)
  		return segs;
  
-@@ -264,7 +264,7 @@ struct sk_buff *tcp_gro_lookup(struct li
+@@ -267,7 +267,7 @@ struct sk_buff *tcp_gro_lookup(struct li
  			continue;
  
  		th2 = tcp_hdr(p);
@@ -876,7 +876,7 @@ SVN-Revision: 35130
  			NAPI_GRO_CB(p)->same_flow = 0;
  			continue;
  		}
-@@ -330,8 +330,8 @@ struct sk_buff *tcp_gro_receive(struct l
+@@ -333,8 +333,8 @@ struct sk_buff *tcp_gro_receive(struct l
  		  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
  	flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
  	for (i = sizeof(*th); i < thlen; i += 4)

target/linux/bcm27xx/patches-6.6/950-0025-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch

@@ -89,7 +89,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  			commit->event = kzalloc(sizeof(*commit->event),
 --- a/drivers/gpu/drm/i915/display/intel_display.c
 +++ b/drivers/gpu/drm/i915/display/intel_display.c
-@@ -7280,6 +7280,19 @@ int intel_atomic_commit(struct drm_devic
+@@ -7298,6 +7298,19 @@ int intel_atomic_commit(struct drm_devic
  				state->base.legacy_cursor_update = false;
  	}
  

target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch

@@ -14,18 +14,14 @@ We don't agree with upstream revert so undo it.
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -480,8 +480,10 @@ static void xhci_pci_quirks(struct devic
- 			pdev->device == 0x3432)
- 		xhci->quirks |= XHCI_BROKEN_STREAMS;
- 
--	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483)
-+	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+@@ -485,6 +485,7 @@ static void xhci_pci_quirks(struct devic
+ 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == PCI_DEVICE_ID_VIA_VL805) {
  		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
 +		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
-+	}
+ 	}
  
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
- 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
 @@ -635,8 +635,11 @@ static int xhci_move_dequeue_past_td(str

target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch

@@ -17583,7 +17583,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	 * For devices with more than one control interface, we assume the
 --- a/sound/usb/quirks.c
 +++ b/sound/usb/quirks.c
-@@ -2253,6 +2253,8 @@ static const struct usb_audio_quirk_flag
+@@ -2254,6 +2254,8 @@ static const struct usb_audio_quirk_flag
  		   QUIRK_FLAG_ALIGN_TRANSFER),
  	DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
  		   QUIRK_FLAG_ALIGN_TRANSFER),

target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch

@@ -24,9 +24,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -483,6 +483,7 @@ static void xhci_pci_quirks(struct devic
- 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+@@ -486,6 +486,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
 +		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  	}

target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch

@@ -1,32 +0,0 @@
-From bab2f1e4e90675af7ea6b48b5c28eb94e22cecd7 Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Thu, 13 Jul 2023 15:06:54 +0100
-Subject: [PATCH 0483/1085] usb: xhci: borrow upstream TRB_FETCH quirk on VL805
- hosts
-
-This reimplements 5a57342 usb: xhci: add VLI_TRB_CACHE_BUG quirk
-
-The downstream implementation required a fair bit of driver surgery to
-allow for truncated ring segments, which needed to shrink by a small
-amount to avoid the cache prefetcher from reading off the end of one
-segment and into another.
-
-An upstream implementation for a similar bug on a different controller
-just doubles the size of the memory allocated for ring segments, which
-is a bit more wasteful (+4K per allocation) but means less code churn.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
----
- drivers/usb/host/xhci-pci.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -484,6 +484,7 @@ static void xhci_pci_quirks(struct devic
- 		xhci->quirks |= XHCI_LPM_SUPPORT;
- 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
- 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
-+		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
- 	}
- 
- 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&

target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch

@@ -90,10 +90,10 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* Allow 3 retries for everything but isoc, set CErr = 3 */
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -485,6 +485,7 @@ static void xhci_pci_quirks(struct devic
+@@ -487,6 +487,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
- 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
 +		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
  	}
  

target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch

@@ -45,9 +45,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 +#define VL805_FW_VER_0138C0	0x0138C0
 +
  /* Device for a quirk */
- #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
- #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
-@@ -295,6 +297,16 @@ static int xhci_pci_reinit(struct xhci_h
+ #define PCI_VENDOR_ID_FRESCO_LOGIC		0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK		0x1000
+@@ -297,6 +299,16 @@ static int xhci_pci_reinit(struct xhci_h
  	return 0;
  }
  
@@ -64,9 +64,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
  {
  	struct pci_dev                  *pdev = to_pci_dev(dev);
-@@ -486,6 +498,8 @@ static void xhci_pci_quirks(struct devic
+@@ -488,6 +500,8 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
- 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
  		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
 +		if (xhci_vl805_get_fw_version(pdev) < VL805_FW_VER_0138C0)
 +			xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;

target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch

@@ -134,7 +134,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	struct napi_struct	napi_tx;
  
  	dma_addr_t		rx_ring_dma;
-@@ -1285,9 +1304,15 @@ struct macb {
+@@ -1287,9 +1306,15 @@ struct macb {
  
  	u32			caps;
  	unsigned int		dma_burst_length;
@@ -222,7 +222,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  				wmb(); // ensure softirq can see update
  			}
  
-@@ -2402,6 +2425,11 @@ static netdev_tx_t macb_start_xmit(struc
+@@ -2404,6 +2427,11 @@ static netdev_tx_t macb_start_xmit(struc
  	skb_tx_timestamp(skb);
  
  	spin_lock_irq(&bp->lock);
@@ -234,7 +234,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
  	spin_unlock_irq(&bp->lock);
  
-@@ -2776,6 +2804,37 @@ static void macb_configure_dma(struct ma
+@@ -2778,6 +2806,37 @@ static void macb_configure_dma(struct ma
  	}
  }
  
@@ -272,7 +272,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void macb_init_hw(struct macb *bp)
  {
  	u32 config;
-@@ -2804,6 +2863,11 @@ static void macb_init_hw(struct macb *bp
+@@ -2806,6 +2865,11 @@ static void macb_init_hw(struct macb *bp
  	if (bp->caps & MACB_CAPS_JUMBO)
  		bp->rx_frm_len_mask = MACB_RX_JFRMLEN_MASK;
  
@@ -284,7 +284,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	macb_configure_dma(bp);
  
  	/* Enable RX partial store and forward and set watermark */
-@@ -3165,6 +3229,52 @@ static void gem_get_ethtool_strings(stru
+@@ -3170,6 +3234,52 @@ static void gem_get_ethtool_strings(stru
  	}
  }
  
@@ -337,7 +337,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static struct net_device_stats *macb_get_stats(struct net_device *dev)
  {
  	struct macb *bp = netdev_priv(dev);
-@@ -3757,6 +3867,8 @@ static const struct ethtool_ops macb_eth
+@@ -3764,6 +3874,8 @@ static const struct ethtool_ops macb_eth
  };
  
  static const struct ethtool_ops gem_ethtool_ops = {
@@ -346,7 +346,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	.get_regs_len		= macb_get_regs_len,
  	.get_regs		= macb_get_regs,
  	.get_wol		= macb_get_wol,
-@@ -3766,6 +3878,8 @@ static const struct ethtool_ops gem_etht
+@@ -3773,6 +3885,8 @@ static const struct ethtool_ops gem_etht
  	.get_ethtool_stats	= gem_get_ethtool_stats,
  	.get_strings		= gem_get_ethtool_strings,
  	.get_sset_count		= gem_get_sset_count,
@@ -355,7 +355,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	.get_link_ksettings     = macb_get_link_ksettings,
  	.set_link_ksettings     = macb_set_link_ksettings,
  	.get_ringparam		= macb_get_ringparam,
-@@ -5062,6 +5176,11 @@ static int macb_probe(struct platform_de
+@@ -5069,6 +5183,11 @@ static int macb_probe(struct platform_de
  			}
  		}
  	}
@@ -365,9 +365,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 +	bp->use_aw2b_fill = device_property_read_bool(&pdev->dev, "cdns,use-aw2b-fill");
 +
  	spin_lock_init(&bp->lock);
+ 	spin_lock_init(&bp->stats_lock);
  
- 	/* setup capabilities */
-@@ -5117,6 +5236,21 @@ static int macb_probe(struct platform_de
+@@ -5125,6 +5244,21 @@ static int macb_probe(struct platform_de
  	else
  		bp->phy_interface = interface;
  
@@ -389,7 +389,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* IP specific init */
  	err = init(pdev);
  	if (err)
-@@ -5193,6 +5327,19 @@ static int macb_remove(struct platform_d
+@@ -5201,6 +5335,19 @@ static int macb_remove(struct platform_d
  	return 0;
  }
  
@@ -409,7 +409,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static int __maybe_unused macb_suspend(struct device *dev)
  {
  	struct net_device *netdev = dev_get_drvdata(dev);
-@@ -5407,6 +5554,7 @@ static const struct dev_pm_ops macb_pm_o
+@@ -5415,6 +5562,7 @@ static const struct dev_pm_ops macb_pm_o
  static struct platform_driver macb_driver = {
  	.probe		= macb_probe,
  	.remove		= macb_remove,

target/linux/bcm27xx/patches-6.6/950-0853-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch

@@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -1372,6 +1372,9 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1367,6 +1367,9 @@ static int dwc3_core_init(struct dwc3 *d
  		if (dwc->parkmode_disable_hs_quirk)
  			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_HS;
  
@@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		if (DWC3_VER_IS_WITHIN(DWC3, 290A, ANY) &&
  		    (dwc->maximum_speed == USB_SPEED_HIGH ||
  		     dwc->maximum_speed == USB_SPEED_FULL))
-@@ -1661,6 +1664,8 @@ static void dwc3_get_properties(struct d
+@@ -1634,6 +1637,8 @@ static void dwc3_get_properties(struct d
  				"snps,parkmode-disable-ss-quirk");
  	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
  				"snps,parkmode-disable-hs-quirk");
@@ -37,7 +37,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
 --- a/drivers/usb/dwc3/core.h
 +++ b/drivers/usb/dwc3/core.h
-@@ -271,6 +271,7 @@
+@@ -268,6 +268,7 @@
  #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
@@ -45,7 +45,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  #define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST	BIT(10)
  
  /* Global Status Register */
-@@ -1122,10 +1123,12 @@ struct dwc3_scratchpad_array {
+@@ -1118,10 +1119,12 @@ struct dwc3_scratchpad_array {
   *			generation after resume from suspend.
   * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
   *			VBUS with an external supply.
@@ -62,7 +62,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
   * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
   * @tx_de_emphasis: Tx de-emphasis value
   *	0	- -6dB de-emphasis
-@@ -1352,6 +1355,7 @@ struct dwc3 {
+@@ -1347,6 +1350,7 @@ struct dwc3 {
  	unsigned		ulpi_ext_vbus_drv:1;
  	unsigned		parkmode_disable_ss_quirk:1;
  	unsigned		parkmode_disable_hs_quirk:1;

target/linux/bcm27xx/patches-6.6/950-1359-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch

@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -1366,6 +1366,12 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1361,6 +1361,12 @@ static int dwc3_core_init(struct dwc3 *d
  		if (dwc->dis_tx_ipgap_linecheck_quirk)
  			reg |= DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS;
  
@@ -35,7 +35,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		if (dwc->parkmode_disable_ss_quirk)
  			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_SS;
  
-@@ -1660,6 +1666,10 @@ static void dwc3_get_properties(struct d
+@@ -1633,6 +1639,10 @@ static void dwc3_get_properties(struct d
  				"snps,resume-hs-terminations");
  	dwc->ulpi_ext_vbus_drv = device_property_read_bool(dev,
  				"snps,ulpi-ext-vbus-drv");
@@ -48,7 +48,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
 --- a/drivers/usb/dwc3/core.h
 +++ b/drivers/usb/dwc3/core.h
-@@ -269,6 +269,8 @@
+@@ -266,6 +266,8 @@
  #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS	BIT(28)
  #define DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK	BIT(26)
  #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
@@ -57,7 +57,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_FSLS	BIT(15)
-@@ -1123,6 +1125,8 @@ struct dwc3_scratchpad_array {
+@@ -1119,6 +1121,8 @@ struct dwc3_scratchpad_array {
   *			generation after resume from suspend.
   * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
   *			VBUS with an external supply.
@@ -66,7 +66,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
   * @parkmode_disable_ss_quirk: If set, disable park mode feature for all
   *			Superspeed instances.
   * @parkmode_disable_hs_quirk: If set, disable park mode feature for all
-@@ -1353,6 +1357,8 @@ struct dwc3 {
+@@ -1348,6 +1352,8 @@ struct dwc3 {
  	unsigned		dis_tx_ipgap_linecheck_quirk:1;
  	unsigned		resume_hs_terminations:1;
  	unsigned		ulpi_ext_vbus_drv:1;

target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch

@@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/net/ethernet/cadence/macb_main.c
 +++ b/drivers/net/ethernet/cadence/macb_main.c
-@@ -5023,6 +5023,17 @@ static const struct macb_config versal_c
+@@ -5030,6 +5030,17 @@ static const struct macb_config versal_c
  	.usrio = &macb_default_usrio,
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static const struct of_device_id macb_dt_ids[] = {
  	{ .compatible = "cdns,at91sam9260-macb", .data = &at91sam9260_config },
  	{ .compatible = "cdns,macb" },
-@@ -5043,6 +5054,7 @@ static const struct of_device_id macb_dt
+@@ -5050,6 +5061,7 @@ static const struct of_device_id macb_dt
  	{ .compatible = "microchip,mpfs-macb", .data = &mpfs_config },
  	{ .compatible = "microchip,sama7g5-gem", .data = &sama7g5_gem_config },
  	{ .compatible = "microchip,sama7g5-emac", .data = &sama7g5_emac_config },

target/linux/bcm27xx/patches-6.6/950-1484-Add-and-update-files-for-pwm-gpio-fan-overlay.patch

@@ -0,0 +1,246 @@
+From 5fa4b1ff4db7635da04b1b8bf33b42a941064718 Mon Sep 17 00:00:00 2001
+From: Kai-Uwe Herbing <155751635+herbingk@users.noreply.github.com>
+Date: Tue, 31 Dec 2024 19:44:31 +0100
+Subject: [PATCH] Add and update files for pwm-gpio-fan overlay
+
+Add and update files for pwm-gpio-fan overlay
+Signed-off-by: Kai-Uwe Herbing <155751635+herbingk@users.noreply.github.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  40 +++++
+ .../dts/overlays/pwm-gpio-fan-overlay.dts     | 170 ++++++++++++++++++
+ 3 files changed, 211 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-gpio-fan-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -219,6 +219,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pwm.dtbo \
+ 	pwm-2chan.dtbo \
+ 	pwm-gpio.dtbo \
++	pwm-gpio-fan.dtbo \
+ 	pwm-ir-tx.dtbo \
+ 	pwm-pio.dtbo \
+ 	pwm1.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4036,6 +4036,46 @@ Load:   dtoverlay=pwm-gpio,<param>=<val>
+ Params: gpio                    Output pin (default 4)
+ 
+ 
++Name:   pwm-gpio-fan
++Info:   Configure a GPIO connected PWM cooling fan controlled by the
++        software-based GPIO PWM kernel module
++Load:   dtoverlay=pwm-gpio-fan,<param>=<val>
++Params: fan_gpio                BCM number of the pin driving the fan,
++                                default 18 (GPIO 18)
++        fan_temp0               CPU temperature at which fan is started with
++                                low speed in millicelsius,
++                                default 55000 (55 °C)
++        fan_temp1               CPU temperature at which fan is switched
++                                to medium speed in millicelsius,
++                                default 60000 (60 °C)
++        fan_temp2               CPU temperature at which fan is switched
++                                to high speed in millicelsius,
++                                default 67500 (67.5 °C)
++        fan_temp3               CPU temperature at which fan is switched
++                                to max speed in millicelsius,
++                                default 75000 (75 °C)
++        fan_temp0_hyst          Temperature hysteris at which fan is stopped
++                                in millicelsius,default 5000 (resulting
++                                in 50 °C)
++        fan_temp1_hyst          Temperature hysteris at which fan is switched
++                                back to low speed in millicelsius,
++                                default 5000 (resulting in 55 °C)
++        fan_temp2_hyst          Temperature hysteris at which fan is switched
++                                back to medium speed in millicelsius,
++                                default 5000 (resulting in 62.5 °C)
++        fan_temp3_hyst          Temperature hysteris at which fan is switched
++                                back to high speed in millicelsius,
++                                default 5000 (resulting in 70 °C)
++        fan_temp0_speed         Fan speed for low cooling state in range
++                                0 to 255, default 114 (45% PWM duty cycle)
++        fan_temp1_speed         Fan speed for medium cooling state in range
++                                0 to 255, default 152 (60% PWM duty cycle)
++        fan_temp2_speed         Fan speed for high cooling state in range
++                                0 to 255, default 204 (80% PWM duty cycle)
++        fan_temp3_speed         Fan speed for max cooling state in range
++                                0 to 255, default 255 (100% PWM duty cycle)
++
++
+ Name:   pwm-ir-tx
+ Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
+         This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-gpio-fan-overlay.dts
+@@ -0,0 +1,170 @@
++/*
++ * Overlay for a GPIO connected PWM cooling fan controlled by software GPIO PWM
++ *
++ * Optional parameters:
++ *  - "fan_gpio"	BCM number of the pin driving the fan, default 18 (GPIO18)
++ *
++ *  - "fan_temp0"	CPU temperature at which fan is started with low speed in millicelsius,
++ *			default 55000 (55 °C)
++ *  - "fan_temp1"	CPU temperature at which fan is switched to medium speed in millicelsius,
++ *			default 60000  (60 °C)
++ *  - "fan_temp2"	CPU temperature at which fan is switched to high speed in millicelsius,
++ *			default 67500  (67.5 °C)
++ *  - "fan_temp3"	CPU temperature at which fan is switched to max speed in millicelsius,
++ *			default 75000  (75 °C)
++ *  - "fan_temp0_hyst"	Temperature hysteris at which fan is stopped in millicelsius,
++ *			default 5000 (resulting in 50 °C)
++ *  - "fan_temp1_hyst"	Temperature hysteris at which fan is switched back to low speed
++ *			in millicelsius, default 5000 (resulting in 55 °C)
++ *  - "fan_temp2_hyst"	Temperature hysteris at which fan is switched back to medium speed
++ *			in millicelsius, default 5000 (resulting in 62.5 °C)
++ *  - "fan_temp3_hyst"	Temperature hysteris at which fan is switched back to high speed
++ *			in millicelsius, default 5000 (resulting in 70 °C)
++ *  - "fan_temp0_speed"	Fan speed for low cooling state in range 0 to 255,
++ *			default 114 (45% PWM duty cycle)
++ *  - "fan_temp1_speed"	Fan speed for medium cooling state in range 0 to 255,
++ *			default 152 (60% PWM duty cycle)
++ *  - "fan_temp2_speed"	Fan speed for high cooling state in range 0 to 255,
++ *			default 204 (80% PWM duty cycle)
++ *  - "fan_temp3_speed"	Fan speed for max cooling state in range 0 to 255,
++ *			default 255 (100% PWM duty cycle)
++ *
++ * N.B.
++ *  - Uses the software GPIO PWM kernel module instead of the Pis hardware PWMs (PWM0/PWM1).
++ *    This will allow for an undisturbed concurrent usage of the Pis analogue audio output.
++ *
++ * Requires:
++ *  - A PWM controlled cooling fan connected to the GPIO, such as an
++ *    Argon mini-fan, HighPi Pro Fan or Waveshare FAN-4020-PWM-5V
++ *  - Raspberry Pi OS Bookworm with kernel 6.6.62 or above
++ *
++ * Build:
++ *  - sudo dtc -I dts -O dtb -o /boot/firmware/overlays/pwm-gpiofan.dtbo pwm-gpiofan-overlay.dts
++ *
++ * Activate:
++ *  - sudo nano /boot/firmware/config.txt add "dtoverlay=pwm-gpiofan"
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_gpio_pins: pwm_gpio_pins {
++				brcm,pins = <18>; /* gpio-pin = 18 */
++				brcm,function = <1>; /* gpio function = output */
++				brcm,pull = <0>; /* gpio pull up/down = off */
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_gpio: pwm_gpio {
++				compatible="pwm-gpio";
++				#pwm-cells = <2>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pwm_gpio_pins>;
++				gpios = <&gpio 18 0>; /* gpio-pin = 18 */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			fan0: pwm-fan {
++				compatible = "pwm-fan";
++				#cooling-cells = <2>;
++				/* in ns = 20ms = 50 Hz */
++				pwms = <&pwm_gpio 0 20000000 0>;
++
++				cooling-min-state = <0>;
++				cooling-max-state = <4>;
++				/* PWM duty cycle values in a range from 0 to 255 */
++				/* which correspond to thermal cooling states 0 to 4 */
++				cooling-levels = <0 114 152 204 255>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			/* in ms = poll every 2s */
++			polling-delay = <2000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			/* below temperatures in millicelsius */
++			trip0: trip0 {
++				temperature = <55000>; /* 55 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip1: trip1 {
++				temperature = <60000>; /* 60 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip2: trip2 {
++				temperature = <67500>; /* 67.5 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip3: trip3 {
++				temperature = <75000>; /* 75 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				cooling-device = <&fan0 0 1>;
++				trip = <&trip0>;
++			};
++			map1 {
++				cooling-device = <&fan0 1 2>;
++				trip = <&trip1>;
++			};
++			map2 {
++				cooling-device = <&fan0 2 3>;
++				trip = <&trip2>;
++			};
++			map3 {
++				cooling-device = <&fan0 3 4>;
++				trip = <&trip3>;
++			};
++		};
++	};
++
++	__overrides__ {
++		fan_gpio =		<&pwm_gpio>,"gpios:4",
++					<&pwm_gpio_pins>,"brcm,pins:0";
++		fan_temp0 =		<&trip0>,"temperature:0";
++		fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++		fan_temp0_speed =	<&fan0>,"cooling-levels:4";
++		fan_temp1 =		<&trip1>,"temperature:0";
++		fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++		fan_temp1_speed =	<&fan0>,"cooling-levels:8";
++		fan_temp2 =		<&trip2>,"temperature:0";
++		fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++		fan_temp2_speed =	<&fan0>,"cooling-levels:12";
++		fan_temp3 =		<&trip3>,"temperature:0";
++		fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++		fan_temp3_speed =	<&fan0>,"cooling-levels:16";
++	};
++
++};

target/linux/bcm27xx/patches-6.6/950-1486-media-i2c-imx290-Limit-analogue-gain-according-to-mo.patch

@@ -0,0 +1,71 @@
+From b3dd7e8947cddec41864e8d3ce5f5d8b81033d6a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:03 +0000
+Subject: [PATCH] media: i2c: imx290: Limit analogue gain according to module
+
+Commit ec75fd952b0b5cdab7b606cdacba237c57c1fdda upstream.
+
+The imx327 only supports up to 29.4dB of analogue gain, vs
+the imx290 going up to 30dB. Both are in 0.3dB steps.
+
+As we now have model specific config, fix this mismatch,
+and delete the comment referencing it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -178,6 +178,7 @@ struct imx290_model_info {
+ 	enum imx290_colour_variant colour_variant;
+ 	const struct cci_reg_sequence *init_regs;
+ 	size_t init_regs_num;
++	unsigned int max_analog_gain;
+ 	const char *name;
+ };
+ 
+@@ -879,14 +880,10 @@ static int imx290_ctrl_init(struct imx29
+ 	 * up to 72.0dB (240) add further digital gain. Limit the range to
+ 	 * analog gain only, support for digital gain can be added separately
+ 	 * if needed.
+-	 *
+-	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
+-	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
+-	 * gain. When support for those sensors gets added to the driver, the
+-	 * gain control should be adjusted accordingly.
+ 	 */
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
++			  V4L2_CID_ANALOGUE_GAIN, 0,
++			  imx290->model->max_analog_gain, 1, 0);
+ 
+ 	/*
+ 	 * Correct range will be determined through imx290_ctrl_update setting
+@@ -1437,18 +1434,21 @@ static const struct imx290_model_info im
+ 		.colour_variant = IMX290_VARIANT_COLOUR,
+ 		.init_regs = imx290_global_init_settings_290,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.max_analog_gain = 100,
+ 		.name = "imx290",
+ 	},
+ 	[IMX290_MODEL_IMX290LLR] = {
+ 		.colour_variant = IMX290_VARIANT_MONO,
+ 		.init_regs = imx290_global_init_settings_290,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.max_analog_gain = 100,
+ 		.name = "imx290",
+ 	},
+ 	[IMX290_MODEL_IMX327LQR] = {
+ 		.colour_variant = IMX290_VARIANT_COLOUR,
+ 		.init_regs = imx290_global_init_settings_327,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_327),
++		.max_analog_gain = 98,
+ 		.name = "imx327",
+ 	},
+ };

target/linux/bcm27xx/patches-6.6/950-1488-media-dt-bindings-sony-imx290-Add-IMX462-to-the-IMX2.patch

@@ -0,0 +1,31 @@
+From f4f17c3fe223b3d8ad65f5420abbcd69ef901186 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:05 +0000
+Subject: [PATCH] media: dt-bindings: sony,imx290: Add IMX462 to the IMX290
+ binding
+
+Commit e4faac99d5bb4b6c80f2495c40fcd71a67c40b27 upstream.
+
+IMX462 is the successor to IMX290, which is supportable by
+the existing IMX290 driver via a new compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+@@ -30,6 +30,8 @@ properties:
+           - sony,imx290lqr # Colour
+           - sony,imx290llr # Monochrome
+           - sony,imx327lqr # Colour
++          - sony,imx462lqr # Colour
++          - sony,imx462llr # Monochrome
+       - const: sony,imx290
+         deprecated: true
+ 

target/linux/bcm27xx/patches-6.6/950-1489-media-i2c-imx290-Add-configuration-for-IMX462.patch

@@ -0,0 +1,116 @@
+From 23037697914a6d1220768a752c6358d35ca03737 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:06 +0000
+Subject: [PATCH] media: i2c: imx290: Add configuration for IMX462
+
+Commit c699b6c7c857baba1375a1ed090bf71f695e2971 upstream.
+
+IMX462 is the successor to IMX290, and wants very minor
+changes to the register setup.
+
+Add the relevant configuration to support it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 66 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 66 insertions(+)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -172,6 +172,8 @@ enum imx290_model {
+ 	IMX290_MODEL_IMX290LQR,
+ 	IMX290_MODEL_IMX290LLR,
+ 	IMX290_MODEL_IMX327LQR,
++	IMX290_MODEL_IMX462LQR,
++	IMX290_MODEL_IMX462LLR,
+ };
+ 
+ struct imx290_model_info {
+@@ -318,6 +320,50 @@ static const struct cci_reg_sequence imx
+ 	{ CCI_REG8(0x33b3), 0x04 },
+ };
+ 
++static const struct cci_reg_sequence imx290_global_init_settings_462[] = {
++	{ CCI_REG8(0x300f), 0x00 },
++	{ CCI_REG8(0x3010), 0x21 },
++	{ CCI_REG8(0x3011), 0x02 },
++	{ CCI_REG8(0x3016), 0x09 },
++	{ CCI_REG8(0x3070), 0x02 },
++	{ CCI_REG8(0x3071), 0x11 },
++	{ CCI_REG8(0x309b), 0x10 },
++	{ CCI_REG8(0x309c), 0x22 },
++	{ CCI_REG8(0x30a2), 0x02 },
++	{ CCI_REG8(0x30a6), 0x20 },
++	{ CCI_REG8(0x30a8), 0x20 },
++	{ CCI_REG8(0x30aa), 0x20 },
++	{ CCI_REG8(0x30ac), 0x20 },
++	{ CCI_REG8(0x30b0), 0x43 },
++	{ CCI_REG8(0x3119), 0x9e },
++	{ CCI_REG8(0x311c), 0x1e },
++	{ CCI_REG8(0x311e), 0x08 },
++	{ CCI_REG8(0x3128), 0x05 },
++	{ CCI_REG8(0x313d), 0x83 },
++	{ CCI_REG8(0x3150), 0x03 },
++	{ CCI_REG8(0x317e), 0x00 },
++	{ CCI_REG8(0x32b8), 0x50 },
++	{ CCI_REG8(0x32b9), 0x10 },
++	{ CCI_REG8(0x32ba), 0x00 },
++	{ CCI_REG8(0x32bb), 0x04 },
++	{ CCI_REG8(0x32c8), 0x50 },
++	{ CCI_REG8(0x32c9), 0x10 },
++	{ CCI_REG8(0x32ca), 0x00 },
++	{ CCI_REG8(0x32cb), 0x04 },
++	{ CCI_REG8(0x332c), 0xd3 },
++	{ CCI_REG8(0x332d), 0x10 },
++	{ CCI_REG8(0x332e), 0x0d },
++	{ CCI_REG8(0x3358), 0x06 },
++	{ CCI_REG8(0x3359), 0xe1 },
++	{ CCI_REG8(0x335a), 0x11 },
++	{ CCI_REG8(0x3360), 0x1e },
++	{ CCI_REG8(0x3361), 0x61 },
++	{ CCI_REG8(0x3362), 0x10 },
++	{ CCI_REG8(0x33b0), 0x50 },
++	{ CCI_REG8(0x33b2), 0x1a },
++	{ CCI_REG8(0x33b3), 0x04 },
++};
++
+ #define IMX290_NUM_CLK_REGS	2
+ static const struct cci_reg_sequence xclk_regs[][IMX290_NUM_CLK_REGS] = {
+ 	[IMX290_CLK_37_125] = {
+@@ -1451,6 +1497,20 @@ static const struct imx290_model_info im
+ 		.max_analog_gain = 98,
+ 		.name = "imx327",
+ 	},
++	[IMX290_MODEL_IMX462LQR] = {
++		.colour_variant = IMX290_VARIANT_COLOUR,
++		.init_regs = imx290_global_init_settings_462,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_462),
++		.max_analog_gain = 98,
++		.name = "imx462",
++	},
++	[IMX290_MODEL_IMX462LLR] = {
++		.colour_variant = IMX290_VARIANT_MONO,
++		.init_regs = imx290_global_init_settings_462,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_462),
++		.max_analog_gain = 98,
++		.name = "imx462",
++	},
+ };
+ 
+ static int imx290_parse_dt(struct imx290 *imx290)
+@@ -1646,6 +1706,12 @@ static const struct of_device_id imx290_
+ 	}, {
+ 		.compatible = "sony,imx327lqr",
+ 		.data = &imx290_models[IMX290_MODEL_IMX327LQR],
++	}, {
++		.compatible = "sony,imx462lqr",
++		.data = &imx290_models[IMX290_MODEL_IMX462LQR],
++	}, {
++		.compatible = "sony,imx462llr",
++		.data = &imx290_models[IMX290_MODEL_IMX462LLR],
+ 	},
+ 	{ /* sentinel */ },
+ };

target/linux/bcm27xx/patches-6.6/950-1490-media-imx290-Add-module-parameter-to-allow-selection.patch

@@ -0,0 +1,60 @@
+From c633c2e93e460925120e0817c14bbfc444a70226 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 May 2024 12:43:15 +0100
+Subject: [PATCH] media: imx290: Add module parameter to allow selection of HCG
+ mode
+
+The sensor has Low Conversion Gain (HCG) and High Conversion Gain (HCG)
+modes, with the supposedly the HCG mode having better noise performance
+at high gains.
+
+As this parameter changes the gain range of the sensor, it isn't
+possible to make this an automatic property, and there is no
+suitable V4L2 control to set it, so just add it as a module parameter.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx290.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -13,6 +13,7 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/of.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+@@ -41,6 +42,9 @@
+ #define IMX290_WINMODE_720P				(1 << 4)
+ #define IMX290_WINMODE_CROP				(4 << 4)
+ #define IMX290_FR_FDG_SEL				CCI_REG8(0x3009)
++#define IMX290_FDG_HCG					BIT(4)
++#define IMX290_FRSEL_60FPS				BIT(0)
++#define IMX290_FDG_LCG					0
+ #define IMX290_BLKLEVEL					CCI_REG16_LE(0x300a)
+ #define IMX290_GAIN					CCI_REG8(0x3014)
+ #define IMX290_VMAX					CCI_REG24_LE(0x3018)
+@@ -162,6 +166,10 @@
+ 
+ #define IMX290_NUM_SUPPLIES				3
+ 
++static bool hcg_mode;
++module_param(hcg_mode, bool, 0664);
++MODULE_PARM_DESC(hcg_mode, "Enable HCG mode");
++
+ enum imx290_colour_variant {
+ 	IMX290_VARIANT_COLOUR,
+ 	IMX290_VARIANT_MONO,
+@@ -697,7 +705,8 @@ static int imx290_set_data_lanes(struct
+ 		  &ret);
+ 	cci_write(imx290->regmap, IMX290_CSI_LANE_MODE, imx290->nlanes - 1,
+ 		  &ret);
+-	cci_write(imx290->regmap, IMX290_FR_FDG_SEL, 0x01, &ret);
++	cci_write(imx290->regmap, IMX290_FR_FDG_SEL, IMX290_FRSEL_60FPS |
++		  (hcg_mode ? IMX290_FDG_HCG : IMX290_FDG_LCG), &ret);
+ 
+ 	return ret;
+ }

target/linux/bcm27xx/patches-6.6/950-1491-dtoverlays-Switch-imx462-overlay-to-use-the-new-comp.patch

@@ -0,0 +1,47 @@
+From eec7048c4e3aec1aadc21fcffcf6be9f5385f72a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 12 Nov 2024 14:15:30 +0000
+Subject: [PATCH] dtoverlays: Switch imx462 overlay to use the new compatible
+
+Now that imx462 has a separate compatible string, make use of it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/imx462-overlay.dts | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/imx462-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+@@ -1,9 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ // Definitions for IMX462 camera module on VC I2C bus
+ 
+-// IMX462 is the successor to IMX290. The drivers currently don't support
+-// any additional feature of IMX462, so use the IMX290 compatible strings
+-// for now.
++// IMX462 is the successor to IMX290.
+ 
+ /dts-v1/;
+ /plugin/;
+@@ -17,19 +15,17 @@
+ 	// Fragment numbers deliberately high to avoid conflicts with the
+ 	// included imx290_327 overlay file.
+ 
+-	//IMX462 is not defined in the bindings, so use IMX290 for now.
+-
+ 	fragment@101 {
+ 		target = <&cam_node>;
+ 		__overlay__ {
+-			compatible = "sony,imx290lqr";
++			compatible = "sony,imx462lqr";
+ 		};
+ 	};
+ 
+ 	fragment@102 {
+ 		target = <&cam_node>;
+ 		__dormant__ {
+-			compatible = "sony,imx290llr";
++			compatible = "sony,imx462llr";
+ 		};
+ 	};
+ 

target/linux/bcm27xx/patches-6.6/950-1492-media-i2c-imx415-Add-more-clock-configurations.patch

@@ -0,0 +1,327 @@
+From 0a0814f830829b1a377273ddb09c156c84e1a8ca Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Wed, 17 Jan 2024 08:39:36 +0100
+Subject: [PATCH] media: i2c: imx415: Add more clock configurations
+
+Commit b814b5b2ec2d327b79e415c1baa5eecdf9aa786b upstream.
+
+Complete the list from "INCK Setting" section in IMX415-AAQR-C
+(Rev. E19504, 2019/05/21). For consistency suffix all lane rate values by
+UL, which is needed for 2376000000 anyway.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx415.c | 265 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 260 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -124,7 +124,7 @@ struct imx415_clk_params {
+ /* INCK Settings - includes all lane rate and INCK dependent registers */
+ static const struct imx415_clk_params imx415_clk_params[] = {
+ 	{
+-		.lane_rate = 594000000,
++		.lane_rate = 594000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -139,7 +139,37 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
+ 	{
+-		.lane_rate = 720000000,
++		.lane_rate = 594000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x7 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x080 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0984 },
++	},
++	{
++		.lane_rate = 594000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x7 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x080 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 720000000UL,
+ 		.inck = 24000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x054 },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x03B },
+@@ -154,7 +184,22 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0600 },
+ 	},
+ 	{
+-		.lane_rate = 891000000,
++		.lane_rate = 720000000UL,
++		.inck = 72000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0F8 },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B0 },
++		.regs[2] = { IMX415_SYS_MODE, 0x9 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1200 },
++	},
++	{
++		.lane_rate = 891000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -169,7 +214,37 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
+ 	{
+-		.lane_rate = 1440000000,
++		.lane_rate = 891000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x5 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 891000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x5 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 1440000000UL,
+ 		.inck = 24000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x054 },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x03B },
+@@ -184,7 +259,22 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0600 },
+ 	},
+ 	{
+-		.lane_rate = 1485000000,
++		.lane_rate = 1440000000UL,
++		.inck = 72000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0F8 },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B0 },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1200 },
++	},
++	{
++		.lane_rate = 1485000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -198,6 +288,171 @@ static const struct imx415_clk_params im
+ 		.regs[9] = { IMX415_INCKSEL7, 0x0 },
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
++	{
++		.lane_rate = 1485000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 1485000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C6 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E7 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x108 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x100 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x100 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
+ };
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */

target/linux/bcm27xx/patches-6.6/950-1494-dtoverlays-Add-overlay-for-Sony-IMX415-image-sensor.patch

@@ -0,0 +1,214 @@
+From 384e58f63a3a328f7f656052b6357f3408aac6c3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 31 Dec 2024 20:33:46 +0000
+Subject: [PATCH] dtoverlays: Add overlay for Sony IMX415 image sensor
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  31 +++++
+ arch/arm/boot/dts/overlays/imx415-overlay.dts | 116 ++++++++++++++++++
+ arch/arm/boot/dts/overlays/imx415.dtsi        |  27 ++++
+ 4 files changed, 175 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/imx415-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx415.dtsi
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -135,6 +135,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	imx296.dtbo \
+ 	imx327.dtbo \
+ 	imx378.dtbo \
++	imx415.dtbo \
+ 	imx462.dtbo \
+ 	imx477.dtbo \
+ 	imx500.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2859,6 +2859,37 @@ Params: rotation                Mounting
+                                 450000000 (default), 453000000, 456000000.
+ 
+ 
++Name:   imx415
++Info:   Sony IMX415 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants. By default this uses 4 CSI2 data lanes, so requires a
++        Compute Module or Pi5.
++Load:   dtoverlay=imx415,<param>
++Params: addr                    Set I2C address of sensor. Valid values are
++                                0x10, 0x1a, 0x36 and 0x37. Default is 0x37.
++        4lane                   Enable 4 CSI2 data lanes.
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Valid values are 24, 27, 37.125, 72, or
++                                74.25MHz.
++                                The default is 24MHz.
++                                Note that the link frequencies permitted vary
++                                based on the oscillator used.
++        link-frequency          Confgures the link frequency to be used. Note
++                                that the permitted values vary based on
++                                clock-frequency and number of lanes.
++                                The default is 360MHz for 720Mbit/s.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Enable ad5398 VCM associated with the sensor.
++
++
+ Name:   imx462
+ Info:   Sony IMX462 camera module.
+         Uses Unicam 1, which is the standard camera connector on most Pi
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx415-overlay.dts
+@@ -0,0 +1,116 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX415 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <100000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx415.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@201 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@202 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++
++	__overrides__ {
++		addr = <&cam_node>, "reg:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		clock-frequency = <&cam_clk>, "clock-frequency:0";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
++		4lane = <0>, "+201+202";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx415.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an imx415
++
++cam_node: imx415@37 {
++	compatible = "sony,imx415";
++	reg = <0x37>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "inck";
++
++	avdd-supply = <&cam1_reg>;	/* 2.8v */
++	dvdd-supply = <&cam_dummy_reg>;	/* 1.8v */
++	ovdd-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			//clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <360000000>;
++		};
++	};
++};

target/linux/bcm27xx/patches-6.6/950-1495-media-i2c-imx415-Add-read-write-control-of-VBLANK.patch

@@ -0,0 +1,146 @@
+From 4e8d73ce89c6dd6fdcb8dd7df8310762707c5b1a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jan 2025 14:18:25 +0000
+Subject: [PATCH] media: i2c: imx415: Add read/write control of VBLANK
+
+This also requires that the ranges for the exposure control
+are updated.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 52 +++++++++++++++++++++++++-------------
+ 1 file changed, 34 insertions(+), 18 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -25,6 +25,7 @@
+ #define IMX415_PIXEL_ARRAY_WIDTH  3864
+ #define IMX415_PIXEL_ARRAY_HEIGHT 2192
+ #define IMX415_PIXEL_ARRAY_VBLANK 58
++#define IMX415_EXPOSURE_OFFSET	  8
+ 
+ #define IMX415_NUM_CLK_PARAM_REGS 11
+ 
+@@ -56,6 +57,7 @@
+ #define IMX415_OUTSEL		  IMX415_REG_8BIT(0x30C0)
+ #define IMX415_DRV		  IMX415_REG_8BIT(0x30C1)
+ #define IMX415_VMAX		  IMX415_REG_24BIT(0x3024)
++#define IMX415_VMAX_MAX		  0xfffff
+ #define IMX415_HMAX		  IMX415_REG_16BIT(0x3028)
+ #define IMX415_SHR0		  IMX415_REG_24BIT(0x3050)
+ #define IMX415_GAIN_PCG_0	  IMX415_REG_16BIT(0x3090)
+@@ -457,7 +459,6 @@ static const struct imx415_clk_params im
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+ static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x07F0 },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x006F },
+@@ -473,7 +474,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+ static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x042A },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x009F },
+@@ -489,7 +489,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 4-lane 891 Mbps 30 Hz mode */
+ static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x044C },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
+ 	{ IMX415_TCLKPOST, 0x007F },
+@@ -617,6 +616,7 @@ struct imx415 {
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *exposure;
+ 
+ 	unsigned int cur_mode;
+ 	unsigned int num_data_lanes;
+@@ -795,16 +795,37 @@ static int imx415_s_ctrl(struct v4l2_ctr
+ 					     ctrls);
+ 	const struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_subdev_state *state;
++	u32 exposure_max;
+ 	unsigned int vmax;
+ 	unsigned int flip;
+-
+-	if (!sensor->streaming)
+-		return 0;
++	int ret;
+ 
+ 	state = v4l2_subdev_get_locked_active_state(&sensor->subdev);
+ 	format = v4l2_subdev_get_pad_format(&sensor->subdev, state, 0);
+ 
++	if (ctrl->id == V4L2_CID_VBLANK) {
++		exposure_max = format->height + ctrl->val -
++			       IMX415_EXPOSURE_OFFSET;
++		__v4l2_ctrl_modify_range(sensor->exposure,
++					 sensor->exposure->minimum,
++					 exposure_max, sensor->exposure->step,
++					 sensor->exposure->default_value);
++	}
++
++	if (!sensor->streaming)
++		return 0;
++
+ 	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		ret = imx415_write(sensor, IMX415_VMAX,
++				   format->height + ctrl->val);
++		if (ret)
++			return ret;
++		/*
++		 * Deliberately fall through as exposure is set based on VMAX
++		 * which has just changed.
++		 */
++		fallthrough;
+ 	case V4L2_CID_EXPOSURE:
+ 		/* clamp the exposure value to VMAX. */
+ 		vmax = format->height + sensor->vblank->cur.val;
+@@ -840,7 +861,8 @@ static int imx415_ctrls_init(struct imx4
+ 	u64 pixel_rate = supported_modes[sensor->cur_mode].pixel_rate;
+ 	u64 lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	u32 exposure_max = IMX415_PIXEL_ARRAY_HEIGHT +
+-			   IMX415_PIXEL_ARRAY_VBLANK - 8;
++			   IMX415_PIXEL_ARRAY_VBLANK -
++			   IMX415_EXPOSURE_OFFSET;
+ 	u32 hblank;
+ 	unsigned int i;
+ 	int ret;
+@@ -869,8 +891,9 @@ static int imx415_ctrls_init(struct imx4
+ 	if (ctrl)
+ 		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops, V4L2_CID_EXPOSURE,
+-			  4, exposure_max, 1, exposure_max);
++	sensor->exposure = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
++					     V4L2_CID_EXPOSURE, 4,
++					     exposure_max, 1, exposure_max);
+ 
+ 	v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX415_AGAIN_MIN,
+@@ -887,16 +910,9 @@ static int imx415_ctrls_init(struct imx4
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					   V4L2_CID_VBLANK,
+ 					   IMX415_PIXEL_ARRAY_VBLANK,
+-					   IMX415_PIXEL_ARRAY_VBLANK, 1,
+-					   IMX415_PIXEL_ARRAY_VBLANK);
+-	if (sensor->vblank)
+-		sensor->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	/*
+-	 * The pixel rate used here is a virtual value and can be used for
+-	 * calculating the frame rate together with hblank. It may not
+-	 * necessarily be the physically correct pixel clock.
+-	 */
++					   IMX415_VMAX_MAX - IMX415_PIXEL_ARRAY_HEIGHT,
++					   1, IMX415_PIXEL_ARRAY_VBLANK);
++
+ 	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE, pixel_rate,
+ 			  pixel_rate, 1, pixel_rate);
+ 

target/linux/bcm27xx/patches-6.6/950-1496-media-i2c-imx415-Make-HBLANK-controllable-and-in-con.patch

@@ -0,0 +1,231 @@
+From 6722e1358768671c1e5761aa092efb4ae62b2c46 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jan 2025 17:01:34 +0000
+Subject: [PATCH] media: i2c: imx415: Make HBLANK controllable and in
+ consistent units
+
+The control of HMAX documented in the datasheet is consistent
+with being in terms of a scaled INCK, being always 72MHz or
+74.25MHz. It is NOT link frequency dependent, but the minimum
+value for HMAX is dictated by the link frequency.
+
+If PIXEL_RATE is defined as being 12 times the 72 or 74.25MHz,
+and all values are scaled down again when writing HMAX, then
+the numbers all work out regardless of INCK or link frequency.
+Retain an hmax_min (set to the same value as the previous fixed
+hmax register value) to set as the default value to avoid changing
+the behaviour for existing users.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 86 +++++++++++++++++---------------------
+ 1 file changed, 38 insertions(+), 48 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -27,6 +27,9 @@
+ #define IMX415_PIXEL_ARRAY_VBLANK 58
+ #define IMX415_EXPOSURE_OFFSET	  8
+ 
++#define IMX415_PIXEL_RATE_74_25MHZ	891000000
++#define IMX415_PIXEL_RATE_72MHZ		864000000
++
+ #define IMX415_NUM_CLK_PARAM_REGS 11
+ 
+ #define IMX415_REG_8BIT(n)	  ((1 << 16) | (n))
+@@ -59,6 +62,8 @@
+ #define IMX415_VMAX		  IMX415_REG_24BIT(0x3024)
+ #define IMX415_VMAX_MAX		  0xfffff
+ #define IMX415_HMAX		  IMX415_REG_16BIT(0x3028)
++#define IMX415_HMAX_MAX		  0xffff
++#define IMX415_HMAX_MULTIPLIER	  12
+ #define IMX415_SHR0		  IMX415_REG_24BIT(0x3050)
+ #define IMX415_GAIN_PCG_0	  IMX415_REG_16BIT(0x3090)
+ #define IMX415_AGAIN_MIN	  0
+@@ -459,7 +464,6 @@ static const struct imx415_clk_params im
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+ static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_HMAX, 0x07F0 },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x006F },
+ 	{ IMX415_TCLKPREPARE, 0x002F },
+@@ -474,7 +478,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+ static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_HMAX, 0x042A },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x009F },
+ 	{ IMX415_TCLKPREPARE, 0x0057 },
+@@ -489,7 +492,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 4-lane 891 Mbps 30 Hz mode */
+ static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_HMAX, 0x044C },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
+ 	{ IMX415_TCLKPOST, 0x007F },
+ 	{ IMX415_TCLKPREPARE, 0x0037 },
+@@ -507,39 +509,10 @@ struct imx415_mode_reg_list {
+ 	const struct imx415_reg *regs;
+ };
+ 
+-/*
+- * Mode : number of lanes, lane rate and frame rate dependent settings
+- *
+- * pixel_rate and hmax_pix are needed to calculate hblank for the v4l2 ctrl
+- * interface. These values can not be found in the data sheet and should be
+- * treated as virtual values. Use following table when adding new modes.
+- *
+- * lane_rate  lanes    fps     hmax_pix   pixel_rate
+- *
+- *     594      2     10.000     4400       99000000
+- *     891      2     15.000     4400      148500000
+- *     720      2     15.748     4064      144000000
+- *    1782      2     30.000     4400      297000000
+- *    2079      2     30.000     4400      297000000
+- *    1440      2     30.019     4510      304615385
+- *
+- *     594      4     20.000     5500      247500000
+- *     594      4     25.000     4400      247500000
+- *     720      4     25.000     4400      247500000
+- *     720      4     30.019     4510      304615385
+- *     891      4     30.000     4400      297000000
+- *    1440      4     30.019     4510      304615385
+- *    1440      4     60.038     4510      609230769
+- *    1485      4     60.000     4400      594000000
+- *    1782      4     60.000     4400      594000000
+- *    2079      4     60.000     4400      594000000
+- *    2376      4     90.164     4392      891000000
+- */
+ struct imx415_mode {
+ 	u64 lane_rate;
+ 	u32 lanes;
+-	u32 hmax_pix;
+-	u64 pixel_rate;
++	u32 hmax_min;
+ 	struct imx415_mode_reg_list reg_list;
+ };
+ 
+@@ -548,8 +521,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 720000000,
+ 		.lanes = 2,
+-		.hmax_pix = 4064,
+-		.pixel_rate = 144000000,
++		.hmax_min = 2032,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_2_720),
+ 			.regs = imx415_mode_2_720,
+@@ -558,8 +530,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 1440000000,
+ 		.lanes = 2,
+-		.hmax_pix = 4510,
+-		.pixel_rate = 304615385,
++		.hmax_min = 1066,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_2_1440),
+ 			.regs = imx415_mode_2_1440,
+@@ -568,8 +539,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 891000000,
+ 		.lanes = 4,
+-		.hmax_pix = 4400,
+-		.pixel_rate = 297000000,
++		.hmax_min = 1100,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_4_891),
+ 			.regs = imx415_mode_4_891,
+@@ -601,6 +571,7 @@ static const char *const imx415_test_pat
+ struct imx415 {
+ 	struct device *dev;
+ 	struct clk *clk;
++	unsigned long pixel_rate;
+ 	struct regulator_bulk_data supplies[ARRAY_SIZE(imx415_supply_names)];
+ 	struct gpio_desc *reset;
+ 	struct regmap *regmap;
+@@ -614,6 +585,7 @@ struct imx415 {
+ 
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vflip;
+ 	struct v4l2_ctrl *exposure;
+@@ -845,6 +817,11 @@ static int imx415_s_ctrl(struct v4l2_ctr
+ 	case V4L2_CID_TEST_PATTERN:
+ 		return imx415_set_testpattern(sensor, ctrl->val);
+ 
++	case V4L2_CID_HBLANK:
++		return imx415_write(sensor, IMX415_HMAX,
++				    (format->width + ctrl->val) /
++						IMX415_HMAX_MULTIPLIER);
++
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -858,12 +835,11 @@ static int imx415_ctrls_init(struct imx4
+ {
+ 	struct v4l2_fwnode_device_properties props;
+ 	struct v4l2_ctrl *ctrl;
+-	u64 pixel_rate = supported_modes[sensor->cur_mode].pixel_rate;
+ 	u64 lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	u32 exposure_max = IMX415_PIXEL_ARRAY_HEIGHT +
+ 			   IMX415_PIXEL_ARRAY_VBLANK -
+ 			   IMX415_EXPOSURE_OFFSET;
+-	u32 hblank;
++	u32 hblank_min, hblank_max;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -900,12 +876,14 @@ static int imx415_ctrls_init(struct imx4
+ 			  IMX415_AGAIN_MAX, IMX415_AGAIN_STEP,
+ 			  IMX415_AGAIN_MIN);
+ 
+-	hblank = supported_modes[sensor->cur_mode].hmax_pix -
+-		 IMX415_PIXEL_ARRAY_WIDTH;
++	hblank_min = (supported_modes[sensor->cur_mode].hmax_min *
++		      IMX415_HMAX_MULTIPLIER) - IMX415_PIXEL_ARRAY_WIDTH;
++	hblank_max = (IMX415_HMAX_MAX * IMX415_HMAX_MULTIPLIER) -
++		     IMX415_PIXEL_ARRAY_WIDTH;
+ 	ctrl = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+-				 V4L2_CID_HBLANK, hblank, hblank, 1, hblank);
+-	if (ctrl)
+-		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++				 V4L2_CID_HBLANK, hblank_min,
++				 hblank_max, IMX415_HMAX_MULTIPLIER,
++				 hblank_min);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					   V4L2_CID_VBLANK,
+@@ -913,8 +891,9 @@ static int imx415_ctrls_init(struct imx4
+ 					   IMX415_VMAX_MAX - IMX415_PIXEL_ARRAY_HEIGHT,
+ 					   1, IMX415_PIXEL_ARRAY_VBLANK);
+ 
+-	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE, pixel_rate,
+-			  pixel_rate, 1, pixel_rate);
++	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE,
++			  sensor->pixel_rate, sensor->pixel_rate, 1,
++			  sensor->pixel_rate);
+ 
+ 	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					  V4L2_CID_HFLIP, 0, 1, 1, 0);
+@@ -1410,6 +1389,17 @@ static int imx415_parse_hw_config(struct
+ 				    "no valid sensor mode defined\n");
+ 		goto done_endpoint_free;
+ 	}
++	switch (inck) {
++	case 27000000:
++	case 37125000:
++	case 74250000:
++		sensor->pixel_rate = IMX415_PIXEL_RATE_74_25MHZ;
++		break;
++	case 24000000:
++	case 72000000:
++		sensor->pixel_rate = IMX415_PIXEL_RATE_72MHZ;
++		break;
++	}
+ 
+ 	lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	for (i = 0; i < ARRAY_SIZE(imx415_clk_params); ++i) {

target/linux/bcm27xx/patches-6.6/950-1497-media-i2c-imx415-Link-frequencies-are-not-exclusive-.patch

@@ -0,0 +1,136 @@
+From 0292614f8cd061f71f975dae7d74fe5324545321 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 Jan 2025 12:43:01 +0000
+Subject: [PATCH] media: i2c: imx415: Link frequencies are not exclusive to num
+ lanes
+
+The link frequencies are equally valid in 2 or 4 lane modes, but
+they change the hmax_min value for the mode as the MIPI block
+has to have sufficient time to send the pixel data for each line.
+
+Remove the association with number of lanes, and add hmax_min
+configuration for both lane options.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 49 +++++++++++++++++---------------------
+ 1 file changed, 22 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -462,9 +462,8 @@ static const struct imx415_clk_params im
+ 	},
+ };
+ 
+-/* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+-static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
++/* 720 Mbps CSI configuration */
++static const struct imx415_reg imx415_linkrate_720mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x006F },
+ 	{ IMX415_TCLKPREPARE, 0x002F },
+ 	{ IMX415_TCLKTRAIL, 0x002F },
+@@ -476,9 +475,8 @@ static const struct imx415_reg imx415_mo
+ 	{ IMX415_TLPX, 0x0027 },
+ };
+ 
+-/* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+-static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
++/* 1440 Mbps CSI configuration */
++static const struct imx415_reg imx415_linkrate_1440mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x009F },
+ 	{ IMX415_TCLKPREPARE, 0x0057 },
+ 	{ IMX415_TCLKTRAIL, 0x0057 },
+@@ -490,9 +488,8 @@ static const struct imx415_reg imx415_mo
+ 	{ IMX415_TLPX, 0x004F },
+ };
+ 
+-/* all-pixel 4-lane 891 Mbps 30 Hz mode */
+-static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
++/* 891 Mbps */
++static const struct imx415_reg imx415_linkrate_891mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x007F },
+ 	{ IMX415_TCLKPREPARE, 0x0037 },
+ 	{ IMX415_TCLKTRAIL, 0x0037 },
+@@ -511,8 +508,7 @@ struct imx415_mode_reg_list {
+ 
+ struct imx415_mode {
+ 	u64 lane_rate;
+-	u32 lanes;
+-	u32 hmax_min;
++	u32 hmax_min[2];
+ 	struct imx415_mode_reg_list reg_list;
+ };
+ 
+@@ -520,29 +516,26 @@ struct imx415_mode {
+ static const struct imx415_mode supported_modes[] = {
+ 	{
+ 		.lane_rate = 720000000,
+-		.lanes = 2,
+-		.hmax_min = 2032,
++		.hmax_min = { 2032, 1066 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_2_720),
+-			.regs = imx415_mode_2_720,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_720mbps),
++			.regs = imx415_linkrate_720mbps,
+ 		},
+ 	},
+ 	{
+ 		.lane_rate = 1440000000,
+-		.lanes = 2,
+-		.hmax_min = 1066,
++		.hmax_min = { 1066, 533 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_2_1440),
+-			.regs = imx415_mode_2_1440,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_1440mbps),
++			.regs = imx415_linkrate_1440mbps,
+ 		},
+ 	},
+ 	{
+ 		.lane_rate = 891000000,
+-		.lanes = 4,
+-		.hmax_min = 1100,
++		.hmax_min = { 1100, 550 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_4_891),
+-			.regs = imx415_mode_4_891,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_891mbps),
++			.regs = imx415_linkrate_891mbps,
+ 		},
+ 	},
+ };
+@@ -876,7 +869,7 @@ static int imx415_ctrls_init(struct imx4
+ 			  IMX415_AGAIN_MAX, IMX415_AGAIN_STEP,
+ 			  IMX415_AGAIN_MIN);
+ 
+-	hblank_min = (supported_modes[sensor->cur_mode].hmax_min *
++	hblank_min = (supported_modes[sensor->cur_mode].hmax_min[sensor->num_data_lanes == 2 ? 0 : 1] *
+ 		      IMX415_HMAX_MULTIPLIER) - IMX415_PIXEL_ARRAY_WIDTH;
+ 	hblank_max = (IMX415_HMAX_MAX * IMX415_HMAX_MULTIPLIER) -
+ 		     IMX415_PIXEL_ARRAY_WIDTH;
+@@ -944,7 +937,11 @@ static int imx415_set_mode(struct imx415
+ 			return ret;
+ 	}
+ 
+-	return 0;
++	ret = imx415_write(sensor, IMX415_LANEMODE,
++			   sensor->num_data_lanes == 2 ? IMX415_LANEMODE_2 :
++							 IMX415_LANEMODE_4);
++
++	return ret;
+ }
+ 
+ static int imx415_setup(struct imx415 *sensor, struct v4l2_subdev_state *state)
+@@ -1373,8 +1370,6 @@ static int imx415_parse_hw_config(struct
+ 		}
+ 
+ 		for (j = 0; j < ARRAY_SIZE(supported_modes); ++j) {
+-			if (sensor->num_data_lanes != supported_modes[j].lanes)
+-				continue;
+ 			if (bus_cfg.link_frequencies[i] * 2 !=
+ 			    supported_modes[j].lane_rate)
+ 				continue;

target/linux/bcm27xx/patches-6.6/950-1498-dts-bcm2711-PL011-UARTs-are-actually-r1p5.patch

@@ -0,0 +1,60 @@
+From 87fc066350358ce45f5ad52424c8a2e351b1720c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Jan 2025 12:05:41 +0000
+Subject: [PATCH] dts: bcm2711: PL011 UARTs are actually r1p5
+
+The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -134,7 +134,7 @@
+ 			clocks = <&clocks BCM2835_CLOCK_UART>,
+ 				 <&clocks BCM2835_CLOCK_VPU>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -145,7 +145,7 @@
+ 			clocks = <&clocks BCM2835_CLOCK_UART>,
+ 				 <&clocks BCM2835_CLOCK_VPU>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -156,7 +156,7 @@
+ 			clocks = <&clocks BCM2835_CLOCK_UART>,
+ 				 <&clocks BCM2835_CLOCK_VPU>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -167,7 +167,7 @@
+ 			clocks = <&clocks BCM2835_CLOCK_UART>,
+ 				 <&clocks BCM2835_CLOCK_VPU>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -1155,6 +1155,7 @@
+ };
+ 
+ &uart0 {
++	arm,primecell-periphid = <0x00341011>;
+ 	interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ 

target/linux/bcm27xx/patches-6.6/950-1499-dts-bcm2712-PL011-UARTs-are-actually-r1p5.patch

@@ -0,0 +1,43 @@
+From 602be52637ecca0b247cf832c8a4ec345844d325 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Jan 2025 12:09:48 +0000
+Subject: [PATCH] dts: bcm2712: PL011 UARTs are actually r1p5
+
+The ARM PL011 UART instances in BCM2712 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -190,7 +190,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -201,7 +201,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -212,7 +212,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 

target/linux/bcm27xx/patches-6.6/950-1500-dts-rp1-PL011-UARTs-are-actually-r1p5.patch

@@ -0,0 +1,70 @@
+From 7a4972f36a63eba4d862115265a7bf77ac1e4129 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Jan 2025 12:11:10 +0000
+Subject: [PATCH] dts: rp1: PL011 UARTs are actually r1p5
+
+The ARM PL011 UART instances in RP1 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -69,7 +69,7 @@
+ 			       <&rp1_dma RP1_DMA_UART0_RX>;
+ 			dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -86,7 +86,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART1_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -103,7 +103,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART2_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -120,7 +120,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART3_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -137,7 +137,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART4_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -154,7 +154,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART5_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;

target/linux/bcm27xx/patches-6.6/950-1501-ASoC-pcm512x-Demote-No-SCLK-to-debug-level.patch

@@ -0,0 +1,25 @@
+From 4f7341263ebd6ab2ae805c8f27191d24abc05a62 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:48:35 +0000
+Subject: [PATCH] ASoC: pcm512x: Demote "No SCLK" to debug level
+
+Designing a PCM512X-based soundcard with no external SCLK is a valid
+choice supported by the driver. Don't alarm users with messages that
+say "No SCLK, using BCLK: -2" - reclassify them as debug information.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/codecs/pcm512x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -630,7 +630,7 @@ static int pcm512x_dai_startup_slave(str
+ 	struct regmap *regmap = pcm512x->regmap;
+ 
+ 	if (IS_ERR(pcm512x->sclk)) {
+-		dev_info(dev, "No SCLK, using BCLK: %ld\n",
++		dev_dbg(dev, "No SCLK, using BCLK: %ld\n",
+ 			 PTR_ERR(pcm512x->sclk));
+ 
+ 		/* Disable reporting of missing SCLK as an error */

target/linux/bcm27xx/patches-6.6/950-1502-ASoC-allo-piano-dac-plus-Fix-volume-limiting.patch

@@ -0,0 +1,58 @@
+From 4111f4ede92b1f5bf869f87c66fc39151999c42f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:46:30 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Fix volume limiting
+
+Controls which only exist when snd_soc_register_card returns can't be
+modified before then. Move the setting of volume limits to just before
+the end of the probe function.
+
+Link: https://github.com/raspberrypi/linux/issues/6527
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -734,18 +734,6 @@ static int snd_allo_piano_dac_init(struc
+ 	if (digital_gain_0db_limit) {
+ 		int ret;
+ 
+-		ret = snd_soc_limit_volume(card, "Master Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set master volume limit: %d\n",
+-				ret);
+-
+-		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set subwoofer volume limit: %d\n",
+-				ret);
+-
+ 		//Set volume limit on both dacs
+ 		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+ 			char cname[256];
+@@ -1000,6 +988,20 @@ static int snd_allo_piano_dac_probe(stru
+ 		if (ret < 0)
+ 			return dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n");
+ 
++		if (digital_gain_0db_limit) {
++			ret = snd_soc_limit_volume(card, "Master Playback Volume",
++						207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set master volume limit: %d\n",
++					ret);
++
++			ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
++						207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set subwoofer volume limit: %d\n",
++					ret);
++		}
++
+ 		if ((mute_gpio[0]) && (mute_gpio[1]))
+ 			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+ 

target/linux/bcm27xx/patches-6.6/950-1503-ASoC-allo-piano-dac-plus-Remove-pointless-code.patch

@@ -0,0 +1,53 @@
+From 62c33972e3eb724d80179fb71b05e923920f0b0d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 16:05:02 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Remove pointless code
+
+The codec control Digital Playback Volume is one of the controls deleted
+by the allo-piano-dac-plus driver. It is effectively replaced by the
+soundcard controls Master Playback Volume and Subwoofer Playback Volume.
+
+Delete the code that sets the volume limit on those codec controls - the
+limits on the soundcard volume controls are sufficient.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 20 +-------------------
+ 1 file changed, 1 insertion(+), 19 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -731,21 +731,6 @@ static int snd_allo_piano_dac_init(struc
+ 
+ 	mutex_init(&glb_ptr->lock);
+ 
+-	if (digital_gain_0db_limit) {
+-		int ret;
+-
+-		//Set volume limit on both dacs
+-		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+-			char cname[256];
+-
+-			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[0]);
+-			ret = snd_soc_limit_volume(card, cname, 207);
+-			if (ret < 0)
+-				dev_warn(card->dev, "Failed to set %s volume limit: %d\n",
+-					 cname, ret);
+-		}
+-	}
+-
+ 	// Remove codec controls
+ 	for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+ 		for (j = 0; j < ARRAY_SIZE(codec_ctl_name); j++) {
+@@ -753,10 +738,7 @@ static int snd_allo_piano_dac_init(struc
+ 
+ 			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[j]);
+ 			kctl = snd_soc_card_get_kcontrol(card, cname);
+-			if (!kctl) {
+-				dev_err(rtd->card->dev, "Control %s not found\n",
+-				       cname);
+-			} else {
++			if (kctl) {
+ 				kctl->vd[0].access =
+ 					SNDRV_CTL_ELEM_ACCESS_READWRITE;
+ 				snd_ctl_remove(card->snd_card, kctl);

target/linux/bcm27xx/patches-6.6/950-1505-DT-bcm2712-override-supports-cqe-to-a-cell.patch

@@ -0,0 +1,90 @@
+From 301420a8cc44ee457670e015adc3a08cfc4531a9 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 14:58:37 +0000
+Subject: [PATCH] DT: bcm2712: override supports-cqe to a cell
+
+We want to be able to control the interop surface exposed by Command
+Queueing across bcm2712 products to a more restrictive default, with
+selectable disable and permissive behaviour.
+
+Changing the bool to a cell lets it relay a tristate value.
+
+Also add the override parameter to CM5 as CM5-lite may interface with
+arbitrary eMMC or SD cards.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                 | 11 ++++++++---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts  |  4 ++--
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi |  3 ++-
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi         |  2 +-
+ 4 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -405,9 +405,14 @@ Params:
+                                 non-lite SKU of CM4).
+                                 (default "on")
+ 
+-        sd_cqe                  Set to "off" to disable Command Queueing if you
+-                                have an incompatible Class A2 SD card
+-                                (Pi 5 only, default "on")
++        sd_cqe                  Modify Command Queuing behaviour on the main SD
++                                interface. Legal values are:
++                                0: disable CQ
++                                1: allow CQ for known-good SD A2 cards, and all
++                                   eMMC cards
++                                2: allow CQ for all SD A2 cards that aren't
++                                   known-bad, and all eMMC cards.
++                                (2712 only, default "1")
+ 
+         sd_overclock            Clock (in MHz) to use when the MMC framework
+                                 requests 50MHz
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -365,7 +365,7 @@ dpi_16bit_gpio2:        &rp1_dpi_16bit_g
+ 	sd-uhs-sdr50;
+ 	sd-uhs-ddr50;
+ 	sd-uhs-sdr104;
+-	supports-cqe;
++	supports-cqe = <1>;
+ 	cd-gpios = <&gio_aon 5 GPIO_ACTIVE_LOW>;
+ 	//no-1-8-v;
+ 	status = "okay";
+@@ -745,6 +745,6 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 
+ / {
+ 	__overrides__ {
+-		sd_cqe = <&sdio1>, "supports-cqe?";
++		sd_cqe = <&sdio1>, "supports-cqe:0";
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -339,7 +339,7 @@ dpi_16bit_gpio2:        &rp1_dpi_16bit_g
+ 	mmc-hs400-1_8v;
+ 	mmc-hs400-enhanced-strobe;
+ 	broken-cd;
+-	supports-cqe;
++	supports-cqe = <1>;
+ 	status = "okay";
+ };
+ 
+@@ -752,5 +752,6 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 			<&ant2>, "output-low?=on";
+ 		noanthogs = <&ant1>,"status=disabled",
+ 			<&ant2>, "status=disabled";
++		sd_cqe = <&sdio1>, "supports-cqe:0";
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -1210,7 +1210,7 @@
+ 			clocks = <&clk_emmc2>;
+ 			sdhci-caps-mask = <0x0000C000 0x0>;
+ 			sdhci-caps = <0x0 0x0>;
+-			supports-cqe;
++			supports-cqe = <1>;
+ 			mmc-ddr-3_3v;
+ 			status = "disabled";
+ 		};

target/linux/bcm27xx/patches-6.6/950-1506-mmc-sd-filter-card-CQ-support-based-on-an-allow-list.patch

@@ -0,0 +1,57 @@
+From d70a60eb03ae4fc687b91b5f6c4684000be21c5f Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:09:53 +0000
+Subject: [PATCH] mmc: sd: filter card CQ support based on an allow-list
+
+We have found that many SD cards in the field, even of the same make and
+model, have latent bugs in their CQ implementation. Some product lines
+have fewer bugs with newer manufacture dates, but this is not a
+guarantee that a particular card is at a particular firmware revision
+level.
+
+Many of these bugs lead to card hangs or data corruption. Add a quirk to
+mark a card as having a tested, working CQ implementation and ignore the
+capability if absent.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/card.h  | 5 +++++
+ drivers/mmc/core/sd.c    | 4 ++++
+ include/linux/mmc/card.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -292,4 +292,9 @@ static inline int mmc_card_broken_sd_pow
+ 	return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY;
+ }
+ 
++static inline int mmc_card_working_sd_cq(const struct mmc_card *c)
++{
++	return c->quirks & MMC_QUIRK_WORKING_SD_CQ;
++}
++
+ #endif
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1506,6 +1506,10 @@ cont:
+ 			goto free_card;
+ 	}
+ 
++	/* Disallow command queueing on unvetted cards */
++	if (!mmc_card_working_sd_cq(card))
++		card->ext_csd.cmdq_support = false;
++
+ 	/* Enable command queueing if supported */
+ 	if (card->ext_csd.cmdq_support && host->caps2 & MMC_CAP2_CQE) {
+ 		/*
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -297,6 +297,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_SD_CACHE	(1<<15)	/* Disable broken SD cache support */
+ #define MMC_QUIRK_BROKEN_CACHE_FLUSH	(1<<16)	/* Don't flush cache until the write has occurred */
+ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY	(1<<17) /* Disable broken SD poweroff notify support */
++#define MMC_QUIRK_WORKING_SD_CQ	(1<<30)		/* SD card has known-good CQ implementation */
+ #define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
+ 
+ 	bool			written_flag;	/* Indicates eMMC has been written since power on */

target/linux/bcm27xx/patches-6.6/950-1507-mmc-set-MMC_QUIRK_KNOWN_WORKING_SD_CQ-on-Raspberry-P.patch

@@ -0,0 +1,41 @@
+From eb4d8ffb2b007963662be7eca88baf0e5c358bd6 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:18:33 +0000
+Subject: [PATCH] mmc: set MMC_QUIRK_KNOWN_WORKING_SD_CQ on Raspberry Pi class
+ A2 cards
+
+These cards have a known-good CQ implementation and are based on a
+Longsys product. Add the MANFID for Longsys SD, and the particular CID
+details for the Pi card.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/card.h   | 1 +
+ drivers/mmc/core/quirks.h | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -90,6 +90,7 @@ struct mmc_fixup {
+ #define CID_MANFID_KINGSTON     0x70
+ #define CID_MANFID_HYNIX	0x90
+ #define CID_MANFID_KINGSTON_SD	0x9F
++#define CID_MANFID_LONGSYS_SD	0xAD
+ #define CID_MANFID_NUMONYX	0xFE
+ 
+ #define END_FIXUP { NULL }
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -66,6 +66,12 @@ static const struct mmc_fixup __maybe_un
+ 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+ 
++	/* SD A2 allow-list - only trust CQ on these cards */
++	/* Raspberry Pi A2 cards */
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_LONGSYS_SD, 0x4c53, CID_YEAR_ANY, CID_MONTH_ANY,
++		   cid_rev(1, 0, 0, 0), -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_WORKING_SD_CQ, EXT_CSD_REV_ANY),
++
+ 	END_FIXUP
+ };
+ 

target/linux/bcm27xx/patches-6.6/950-1508-mmc-use-downstream-DT-property-to-modify-CQE-and-or-.patch

@@ -0,0 +1,94 @@
+From e72f42ebc9a236c023f8027a37c9351d58e28b05 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 16:02:27 +0000
+Subject: [PATCH] mmc: use downstream DT property to modify CQE and/or SD CQ
+ behaviour
+
+Implement a tristate-style option for "supports-cqe". If the property is
+absent or zero, disable CQ completely. For 1, enable CQ unconditionally
+for eMMC cards, and known-good SD cards. For 2, enable for eMMC cards,
+and all SD cards that are not known-bad.
+
+The sdhci-brcmstb driver needs to know about the tristate as its probe
+sequence would otherwise override a disable in mmc_of_parse().
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/host.c          | 11 ++++++++++-
+ drivers/mmc/core/sd.c            |  4 ++--
+ drivers/mmc/host/sdhci-brcmstb.c |  6 ++++--
+ include/linux/mmc/host.h         |  1 +
+ 4 files changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -275,7 +275,7 @@ EXPORT_SYMBOL(mmc_of_parse_clk_phase);
+ int mmc_of_parse(struct mmc_host *host)
+ {
+ 	struct device *dev = host->parent;
+-	u32 bus_width, drv_type, cd_debounce_delay_ms;
++	u32 bus_width, drv_type, cd_debounce_delay_ms, cq_allow;
+ 	int ret;
+ 
+ 	if (!dev || !dev_fwnode(dev))
+@@ -410,6 +410,15 @@ int mmc_of_parse(struct mmc_host *host)
+ 		host->caps2 &= ~(MMC_CAP2_HS400_1_8V | MMC_CAP2_HS400_1_2V |
+ 				 MMC_CAP2_HS400_ES);
+ 
++	cq_allow = 0;
++	/*
++	 * Downstream property - if a u32 and 2 instead of a bool,
++	 * trust most A2 SD cards claiming CQ support.
++	 */
++	device_property_read_u32(dev, "supports-cqe", &cq_allow);
++	if (cq_allow == 2)
++		host->caps2 |= MMC_CAP2_SD_CQE_PERMISSIVE;
++
+ 	/* Must be after "non-removable" check */
+ 	if (device_property_read_u32(dev, "fixed-emmc-driver-type", &drv_type) == 0) {
+ 		if (host->caps & MMC_CAP_NONREMOVABLE)
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1506,8 +1506,8 @@ cont:
+ 			goto free_card;
+ 	}
+ 
+-	/* Disallow command queueing on unvetted cards */
+-	if (!mmc_card_working_sd_cq(card))
++	/* Disallow command queueing on unvetted cards unless overridden */
++	if (!(host->caps2 & MMC_CAP2_SD_CQE_PERMISSIVE) && !mmc_card_working_sd_cq(card))
+ 		card->ext_csd.cmdq_support = false;
+ 
+ 	/* Enable command queueing if supported */
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -511,7 +511,7 @@ static int sdhci_brcmstb_probe(struct pl
+ 	struct sdhci_pltfm_host *pltfm_host;
+ 	const struct of_device_id *match;
+ 	struct sdhci_brcmstb_priv *priv;
+-	u32 actual_clock_mhz;
++	u32 actual_clock_mhz, cqe;
+ 	struct sdhci_host *host;
+ 	struct resource *iomem;
+ 	bool no_pinctrl = false;
+@@ -540,7 +540,9 @@ static int sdhci_brcmstb_probe(struct pl
+ 	pltfm_host->clk = clk;
+ 
+ 	priv = sdhci_pltfm_priv(pltfm_host);
+-	if (device_property_read_bool(&pdev->dev, "supports-cqe")) {
++	cqe = 0;
++	device_property_read_u32(&pdev->dev, "supports-cqe", &cqe);
++	if (cqe > 0) {
+ 		priv->flags |= BRCMSTB_PRIV_FLAGS_HAS_CQE;
+ 		match_priv->ops->irq = sdhci_brcmstb_cqhci_irq;
+ 	}
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -427,6 +427,7 @@ struct mmc_host {
+ #define MMC_CAP2_CRYPTO		0
+ #endif
+ #define MMC_CAP2_ALT_GPT_TEGRA	(1 << 28)	/* Host with eMMC that has GPT entry at a non-standard location */
++#define MMC_CAP2_SD_CQE_PERMISSIVE	(1 << 31)	/* Ignore allow-list for CQ capable SD card detection */
+ 
+ 	int			fixed_drv_type;	/* fixed driver type for non-removable media */
+ 

target/linux/bcm27xx/patches-6.6/950-1509-misc-rp1-pio-Handle-probe-errors.patch

@@ -0,0 +1,38 @@
+From e56aa0bd2b552daa4349a7eb2e6b0dec81d3e5cc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 9 Jan 2025 16:40:25 +0000
+Subject: [PATCH] misc: rp1-pio: Handle probe errors
+
+Ensure that rp1_pio_open fails if the device failed to probe.
+
+Link: https://github.com/raspberrypi/linux/issues/6593
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1014,6 +1014,9 @@ struct rp1_pio_client *rp1_pio_open(void
+ {
+ 	struct rp1_pio_client *client;
+ 
++	if (!g_pio)
++		return ERR_PTR(-ENOENT);
++
+ 	client = kzalloc(sizeof(*client), GFP_KERNEL);
+ 	if (!client)
+ 		return ERR_PTR(-ENOMEM);
+@@ -1265,9 +1268,8 @@ static int rp1_pio_probe(struct platform
+ 		return dev_err_probe(dev, pdev->id, "alias is missing\n");
+ 
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+-	if (IS_ERR(fw))
+-		return PTR_ERR(fw);
+-
++	if (IS_ERR_OR_NULL(fw))
++		return dev_err_probe(dev, -ENOENT, "failed to contact RP1 firmware\n");
+ 	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
+ 	if (ret < 0)
+ 		return ret;

target/linux/bcm27xx/patches-6.6/950-1510-firmware-rp1-Simplify-rp1_firmware_get.patch

@@ -0,0 +1,84 @@
+From dafde0ac8b6d4b21578a677c8afad8714af47aaf Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 9 Jan 2025 16:33:37 +0000
+Subject: [PATCH] firmware: rp1: Simplify rp1_firmware_get
+
+Simplify the implementation of rp1_firmware_get, requiring its clients
+to have a valid 'firmware' property. Also make it return NULL on error.
+
+Link: https://github.com/raspberrypi/linux/issues/6593
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/rp1.c | 36 +++++++++++++++---------------------
+ 1 file changed, 15 insertions(+), 21 deletions(-)
+
+--- a/drivers/firmware/rp1.c
++++ b/drivers/firmware/rp1.c
+@@ -159,42 +159,36 @@ struct rp1_firmware *rp1_firmware_get(st
+ 	struct device_node *fwnode;
+ 	struct rp1_firmware *fw;
+ 
+-	if (client) {
+-		fwnode = of_parse_phandle(client, "firmware", 0);
+-		if (!fwnode)
+-			fwnode = of_get_parent(client);
+-		if (fwnode && !of_device_is_compatible(fwnode, match)) {
+-			of_node_put(fwnode);
+-			fwnode = NULL;
+-		}
+-	}
+-
+-	if (!fwnode)
+-		fwnode = of_find_matching_node(NULL, rp1_firmware_of_match);
+-
++	if (!client)
++		return NULL;
++	fwnode = of_parse_phandle(client, "firmware", 0);
+ 	if (!fwnode)
+-		return ERR_PTR(-ENOENT);
++		return NULL;
++	if (!of_device_is_compatible(fwnode, match)) {
++		of_node_put(fwnode);
++		return NULL;
++	}
+ 
+ 	pdev = of_find_device_by_node(fwnode);
+ 	of_node_put(fwnode);
+ 
+ 	if (!pdev)
+-		return ERR_PTR(-EPROBE_DEFER);
++		goto err_exit;
+ 
+ 	fw = platform_get_drvdata(pdev);
+ 	if (!fw)
+-		goto err_defer;
++		goto err_exit;
+ 
+ 	if (!kref_get_unless_zero(&fw->consumers))
+-		goto err_defer;
++		goto err_exit;
+ 
+ 	put_device(&pdev->dev);
+ 
+ 	return fw;
+ 
+-err_defer:
++err_exit:
+ 	put_device(&pdev->dev);
+-	return ERR_PTR(-EPROBE_DEFER);
++	return NULL;
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_get);
+ 
+@@ -210,8 +204,8 @@ struct rp1_firmware *devm_rp1_firmware_g
+ 	int ret;
+ 
+ 	fw = rp1_firmware_get(client);
+-	if (IS_ERR(fw))
+-		return fw;
++	if (!fw)
++		return NULL;
+ 
+ 	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
+ 	if (ret)

target/linux/bcm27xx/patches-6.6/950-1512-dts-bcm2711-Don-t-mark-timer-regs-unconfigured.patch

@@ -0,0 +1,44 @@
+From d06cb3534b6553a1f76bef2ddaf833e23dc12a4c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Jan 2025 15:45:11 +0000
+Subject: [PATCH] dts: bcm2711: Don't mark timer regs unconfigured
+
+The DT property arm,cpu-registers-not-fw-configured tells the kernel
+that the ARM architectural timer has not been configured by the
+firmware. This prevents the use of a vDSO - a faster alternative to a
+syscall for some common kernel operations.
+
+However, on Pi 4 the firmware does configure the timer, so this property
+is unnecessary. Delete it.
+
+Also remove it from the bcm2712.dtsi where it should never have been,
+since it is only relevant to 32-bit ARM kernels.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi   | 2 --
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 --
+ 2 files changed, 4 deletions(-)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -451,8 +451,6 @@
+ 					  IRQ_TYPE_LEVEL_LOW)>,
+ 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
+ 					  IRQ_TYPE_LEVEL_LOW)>;
+-		/* This only applies to the ARMv7 stub */
+-		arm,cpu-registers-not-fw-configured;
+ 	};
+ 
+ 	cpus: cpus {
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -741,8 +741,6 @@
+ 					  IRQ_TYPE_LEVEL_LOW)>,
+ 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
+ 					  IRQ_TYPE_LEVEL_LOW)>;
+-		/* This only applies to the ARMv7 stub */
+-		arm,cpu-registers-not-fw-configured;
+ 	};
+ 
+ 	cpus: cpus {

target/linux/bcm27xx/patches-6.6/950-1513-mmc-bcm2835-sdhost-Observe-SWIOTLB-memory-limit.patch

@@ -0,0 +1,29 @@
+From dfff38316c1284c30c68d02cc424bad0562cf253 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Jan 2025 16:33:13 +0000
+Subject: [PATCH] mmc: bcm2835-sdhost Observe SWIOTLB memory limit
+
+Make sure the sdhost driver doesn't use requests bigger than SWIOTLB
+can handle.
+
+Copied from [1].
+
+Link: https://github.com/raspberrypi/linux/issues/6589
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+[1] d4dd9bccf485 ("mmc: bcm2835: Take SWIOTLB memory size limitation
+into account")
+---
+ drivers/mmc/host/bcm2835-sdhost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -1971,7 +1971,7 @@ int bcm2835_sdhost_add_host(struct platf
+ 	}
+ 
+ 	mmc->max_segs = 128;
+-	mmc->max_req_size = 524288;
++	mmc->max_req_size = min_t(size_t, 524288, dma_max_mapping_size(&pdev->dev));
+ 	mmc->max_seg_size = mmc->max_req_size;
+ 	mmc->max_blk_size = 512;
+ 	mmc->max_blk_count =  65535;

target/linux/bcm27xx/patches-6.6/950-1514-drivers-media-pisp_be-Add-support-for-YUV422-planar-.patch

@@ -0,0 +1,31 @@
+From a73ecafc5532e31b184220149cc2863f625700bf Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 15 Jan 2025 09:46:25 +0000
+Subject: [PATCH] drivers: media: pisp_be: Add support for YUV422 planar format
+
+List V4L2_PIX_FMT_YUV422P as supported by the PiSP backend hardware.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../platform/raspberrypi/pisp_be/pisp_be_formats.h     | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be_formats.h
++++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be_formats.h
+@@ -129,6 +129,16 @@ static const struct pisp_be_format suppo
+ 		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 	},
++	{
++		.fourcc		    = V4L2_PIX_FMT_YUV422P,
++		/* 128 alignment to ensure U/V planes are 64 byte aligned. */
++		.align		    = 128,
++		.bit_depth	    = 8,
++		.plane_factor	    = { P3(1), P3(0.5), P3(0.5) },
++		.num_planes	    = 1,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++	},
+ 	/* Multiplane YUV formats */
+ 	{
+ 		.fourcc		    = V4L2_PIX_FMT_YUV420M,

target/linux/bcm27xx/patches-6.6/950-1515-drivers-media-pisp_be-Remove-unused-fields-in-struct.patch

@@ -0,0 +1,82 @@
+From a452251cc286f2799969f047698c76fe3d7862b9 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 16 Jan 2025 10:13:57 +0000
+Subject: [PATCH] drivers: media: pisp_be: Remove unused fields in struct
+ pisp_be_config
+
+These fields should not be set by either the user or the kernel driver
+so remove them. Replace them with padding bytes to maintain backward
+compatibility with existing userland applications.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../linux/media/raspberrypi/pisp_be_config.h  | 42 ++-----------------
+ 1 file changed, 4 insertions(+), 38 deletions(-)
+
+--- a/include/uapi/linux/media/raspberrypi/pisp_be_config.h
++++ b/include/uapi/linux/media/raspberrypi/pisp_be_config.h
+@@ -716,13 +716,6 @@ struct pisp_be_hog_buffer_config {
+ /**
+  * struct pisp_be_config - RaspberryPi PiSP Back End Processing configuration
+  *
+- * @input_buffer:		Input buffer addresses
+- * @tdn_input_buffer:		TDN input buffer addresses
+- * @stitch_input_buffer:	Stitch input buffer addresses
+- * @tdn_output_buffer:		TDN output buffer addresses
+- * @stitch_output_buffer:	Stitch output buffer addresses
+- * @output_buffer:		Output buffers addresses
+- * @hog_buffer:			HOG buffer addresses
+  * @global:			Global PiSP configuration
+  * @input_format:		Input image format
+  * @decompress:			Decompress configuration
+@@ -761,28 +754,10 @@ struct pisp_be_hog_buffer_config {
+  * @output_format:		Output format configuration
+  * @hog:			HOG configuration
+  * @axi:			AXI bus configuration
+- * @lsc_extra:			LSC extra info
+- * @cac_extra:			CAC extra info
+- * @downscale_extra:		Downscaler extra info
+- * @resample_extra:		Resample extra info
+- * @crop:			Crop configuration
+- * @hog_format:			HOG format info
+- * @dirty_flags_bayer:		Bayer enable dirty flags
+- *				(:c:type:`pisp_be_bayer_enable`)
+- * @dirty_flags_rgb:		RGB enable dirty flags
+- *				(:c:type:`pisp_be_rgb_enable`)
+- * @dirty_flags_extra:		Extra dirty flags
+  */
+ struct pisp_be_config {
+-	/* I/O configuration: */
+-	struct pisp_be_input_buffer_config input_buffer;
+-	struct pisp_be_tdn_input_buffer_config tdn_input_buffer;
+-	struct pisp_be_stitch_input_buffer_config stitch_input_buffer;
+-	struct pisp_be_tdn_output_buffer_config tdn_output_buffer;
+-	struct pisp_be_stitch_output_buffer_config stitch_output_buffer;
+-	struct pisp_be_output_buffer_config
+-				output_buffer[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_hog_buffer_config hog_buffer;
++	/* For backward compatibility */
++	uint8_t pad0[112];
+ 	/* Processing configuration: */
+ 	struct pisp_be_global_config global;
+ 	struct pisp_image_format_config input_format;
+@@ -823,17 +798,8 @@ struct pisp_be_config {
+ 				output_format[PISP_BACK_END_NUM_OUTPUTS];
+ 	struct pisp_be_hog_config hog;
+ 	struct pisp_be_axi_config axi;
+-	/* Non-register fields: */
+-	struct pisp_be_lsc_extra lsc_extra;
+-	struct pisp_be_cac_extra cac_extra;
+-	struct pisp_be_downscale_extra
+-				downscale_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_resample_extra resample_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_crop_config crop;
+-	struct pisp_image_format_config hog_format;
+-	__u32 dirty_flags_bayer; /* these use pisp_be_bayer_enable */
+-	__u32 dirty_flags_rgb; /* use pisp_be_rgb_enable */
+-	__u32 dirty_flags_extra; /* these use pisp_be_dirty_t */
++	/* For backward compatibility */
++	uint8_t pad1[84];
+ } __attribute__((packed));
+ 
+ /**

target/linux/bcm27xx/patches-6.6/950-1516-media-imx219-Adjust-PLL-settings-based-on-the-number.patch

@@ -0,0 +1,163 @@
+From 5b958efc20d381ee103103df5df0c88dc02ada18 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Jan 2025 11:08:25 +0000
+Subject: [PATCH] media: imx219: Adjust PLL settings based on the number of
+ MIPI lanes
+
+Commit ceddfd4493b3 ("media: i2c: imx219: Support four-lane operation")
+added support for device tree to allow configuration of the sensor to
+use 4 lanes with a link frequency of 363MHz, and amended the advertised
+pixel rate to 280.8MPix/s.
+
+However it didn't change any of the PLL settings, so actually it would
+have been running effectively overclocked in the MIPI block, and with
+the frame rate and exposure calculations being wrong.
+
+The pixel rate and link frequency advertised were taken from the "Clock
+Setting Example" section of the datasheet. However those are based on an
+external clock of 12MHz, and are unachievable with a clock of 24MHz (it
+seems PREPLLCLK_VT_DIV and PREPLLCK_OP_DIV can ONLY be set via the
+automatic configuration doumented in "9-1-2 EXCK_FREQ setting depend on
+INCK frequency).
+
+Dropping all support for the 363MHz link frequency would cause problems
+for existing users, so allow it from device tree, but log a warning that
+the requested value is not being truly applied.
+
+Fixes: ceddfd4493b3 ("media: i2c: imx219: Support four-lane operation")
+Co-developed-by: Peyton Howe <peyton.howe@bellsouth.net>
+Signed-off-by: Peyton Howe <peyton.howe@bellsouth.net>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 83 +++++++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 19 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -148,10 +148,11 @@
+ 
+ /* Pixel rate is fixed for all the modes */
+ #define IMX219_PIXEL_RATE		182400000
+-#define IMX219_PIXEL_RATE_4LANE		280800000
++#define IMX219_PIXEL_RATE_4LANE		281600000
+ 
+ #define IMX219_DEFAULT_LINK_FREQ	456000000
+-#define IMX219_DEFAULT_LINK_FREQ_4LANE	363000000
++#define IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED	363000000
++#define IMX219_DEFAULT_LINK_FREQ_4LANE	364000000
+ 
+ /* IMX219 native and active pixel array size. */
+ #define IMX219_NATIVE_WIDTH		3296U
+@@ -224,15 +225,6 @@ static const struct cci_reg_sequence imx
+ 	{ CCI_REG8(0x30eb), 0x05 },
+ 	{ CCI_REG8(0x30eb), 0x09 },
+ 
+-	/* PLL Clock Table */
+-	{ IMX219_REG_VTPXCK_DIV, 5 },
+-	{ IMX219_REG_VTSYCK_DIV, 1 },
+-	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
+-	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
+-	{ IMX219_REG_PLL_VT_MPY, 57 },
+-	{ IMX219_REG_OPSYCK_DIV, 1 },
+-	{ IMX219_REG_PLL_OP_MPY, 114 },
+-
+ 	/* Undocumented registers */
+ 	{ CCI_REG8(0x455e), 0x00 },
+ 	{ CCI_REG8(0x471e), 0x4b },
+@@ -316,6 +308,34 @@ static const struct cci_reg_sequence raw
+ 	{ IMX219_REG_OPPXCK_DIV, 10 },
+ };
+ 
++static const struct cci_reg_sequence imx219_2lane_regs[] = {
++	/* PLL Clock Table */
++	{ IMX219_REG_VTPXCK_DIV, 5 },
++	{ IMX219_REG_VTSYCK_DIV, 1 },
++	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PLL_VT_MPY, 57 },
++	{ IMX219_REG_OPSYCK_DIV, 1 },
++	{ IMX219_REG_PLL_OP_MPY, 114 },
++
++	/* 2-Lane CSI Mode */
++	{ IMX219_REG_CSI_LANE_MODE, IMX219_CSI_2_LANE_MODE },
++};
++
++static const struct cci_reg_sequence imx219_4lane_regs[] = {
++	/* PLL Clock Table */
++	{ IMX219_REG_VTPXCK_DIV, 5 },
++	{ IMX219_REG_VTSYCK_DIV, 1 },
++	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PLL_VT_MPY, 88 },
++	{ IMX219_REG_OPSYCK_DIV, 1 },
++	{ IMX219_REG_PLL_OP_MPY, 91 },
++
++	/* 4-Lane CSI Mode */
++	{ IMX219_REG_CSI_LANE_MODE, IMX219_CSI_4_LANE_MODE },
++};
++
+ static const s64 imx219_link_freq_menu[] = {
+ 	IMX219_DEFAULT_LINK_FREQ,
+ };
+@@ -941,9 +961,11 @@ static int imx219_get_selection(struct v
+ 
+ static int imx219_configure_lanes(struct imx219 *imx219)
+ {
+-	return cci_write(imx219->regmap, IMX219_REG_CSI_LANE_MODE,
+-			 imx219->lanes == 2 ? IMX219_CSI_2_LANE_MODE :
+-			 IMX219_CSI_4_LANE_MODE, NULL);
++	/* Write the appropriate PLL settings for the number of MIPI lanes */
++	return cci_multi_reg_write(imx219->regmap,
++				  imx219->lanes == 2 ? imx219_2lane_regs : imx219_4lane_regs,
++				  imx219->lanes == 2 ? ARRAY_SIZE(imx219_2lane_regs) :
++				  ARRAY_SIZE(imx219_4lane_regs), NULL);
+ };
+ 
+ static int imx219_start_streaming(struct imx219 *imx219,
+@@ -1334,6 +1356,7 @@ static int imx219_check_hwcfg(struct dev
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+ 	int ret = -EINVAL;
++	bool link_frequency_valid = false;
+ 
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+@@ -1360,11 +1383,33 @@ static int imx219_check_hwcfg(struct dev
+ 		goto error_out;
+ 	}
+ 
+-	if (ep_cfg.nr_of_link_frequencies != 1 ||
+-	   (ep_cfg.link_frequencies[0] != ((imx219->lanes == 2) ?
+-	    IMX219_DEFAULT_LINK_FREQ : IMX219_DEFAULT_LINK_FREQ_4LANE))) {
+-		dev_err(dev, "Link frequency not supported: %lld\n",
+-			ep_cfg.link_frequencies[0]);
++	if (ep_cfg.nr_of_link_frequencies == 1) {
++		switch (imx219->lanes) {
++		case 2:
++			if (ep_cfg.link_frequencies[0] ==
++						IMX219_DEFAULT_LINK_FREQ)
++				link_frequency_valid = true;
++			break;
++		case 4:
++			if (ep_cfg.link_frequencies[0] ==
++						IMX219_DEFAULT_LINK_FREQ_4LANE)
++				link_frequency_valid = true;
++			else if (ep_cfg.link_frequencies[0] ==
++				   IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED) {
++				dev_warn(dev, "Link frequency of %d not supported, but has been incorrectly advertised previously\n",
++					 IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED);
++				dev_warn(dev, "Using link frequency of %d\n",
++					 IMX219_DEFAULT_LINK_FREQ_4LANE);
++				link_frequency_valid = true;
++			}
++			break;
++		}
++	}
++
++	if (!link_frequency_valid) {
++		dev_err_probe(dev, -EINVAL,
++			      "Link frequency not supported: %lld\n",
++			      ep_cfg.link_frequencies[0]);
+ 		goto error_out;
+ 	}
+ 

target/linux/bcm27xx/patches-6.6/950-1517-IMX219-Add-4-lane-option-to-the-device-tree-overlay.patch

@@ -0,0 +1,55 @@
+From e3297f3fbffdaec8076c00167261f504bb2c64b6 Mon Sep 17 00:00:00 2001
+From: Peyton Howe <peyton.howe@bellsouth.net>
+Date: Sat, 4 Jan 2025 15:15:33 -0500
+Subject: [PATCH] IMX219: Add 4-lane option to the device tree overlay
+
+Signed-off-by: Peyton Howe <peyton.howe@bellsouth.net>
+---
+ arch/arm/boot/dts/overlays/README             |  2 ++
+ arch/arm/boot/dts/overlays/imx219-overlay.dts | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2757,6 +2757,8 @@ Params: rotation                Mounting
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
+         vcm                     Configure a VCM focus drive on the sensor.
++        4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, 4, or 5) or Pi 5.
+ 
+ 
+ Name:   imx258
+--- a/arch/arm/boot/dts/overlays/imx219-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+@@ -65,6 +65,22 @@
+ 		};
+ 	};
+ 
++	fragment@201 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@202 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++					/bits/ 64 <363000000>;
++		};
++	};
++
+ 	__overrides__ {
+ 		rotation = <&cam_node>,"rotation:0";
+ 		orientation = <&cam_node>,"orientation:0";
+@@ -77,6 +93,7 @@
+ 		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
+ 		vcm = <&vcm>, "status=okay",
+ 		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		4lane = <0>, "+201+202";
+ 	};
+ };
+ 

target/linux/bcm27xx/patches-6.6/950-1518-dtoverlays-waveshare-panel-Disable-new-touch-control.patch

@@ -0,0 +1,40 @@
+From 11381ac246576bc84dfc28f6cdd8030305c605aa Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 20 Jan 2025 11:53:04 +0000
+Subject: [PATCH] dtoverlays: waveshare-panel: Disable new touch controller by
+ default
+
+Commit e442e5c1ab6b ("arch:arm:boot:dts:overlays: Added waveshare 13.3inch
+panel support") added an extra touch controller for the new panels.
+On systems with old panels, it ends up spamming the kernel log as that
+touch controller isn't there to respond.
+
+Fixes: e442e5c1ab6b ("arch:arm:boot:dts:overlays: Added waveshare 13.3inch panel support")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts   | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -55,6 +55,7 @@
+ 			touch2: ilitek@41 {
+ 				compatible = "ilitek,ili251x";
+ 				reg = <0x41>;
++				status = "disabled";
+ 			};
+ 		};
+ 	};
+@@ -125,8 +126,10 @@
+ 				   <&touch>, "touchscreen-inverted-x?",
+ 				   <&touch>, "touchscreen-inverted-y?";
+ 		8_8_inch = <&panel>, "compatible=waveshare,8.8inch-panel";
+-		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel";
+-		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel";
++		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel",
++				  <&touch2>, "status=okay";
++		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel",
++				  <&touch2>, "status=okay";
+ 		i2c1 = <&i2c_frag>, "target:0=",<&i2c1>,
+ 		       <0>, "-3-4+5";
+ 		disable_touch = <&touch>, "status=disabled";

target/linux/bcm27xx/patches-6.6/950-1519-drm-rp1-rp1-dpi-Add-rgb_order-property-to-match-VC4-.patch

@@ -0,0 +1,325 @@
+From ba9883e3b667e4f1fbeacc4346f6e9179a3a5479 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Mon, 20 Jan 2025 11:20:48 +0000
+Subject: [PATCH] drm: rp1: rp1-dpi: Add "rgb_order" property (to match VC4
+ DPI)
+
+As on VC4, the OF property overrides the order implied by media
+bus format. Only 4 of the 6 possible orders are supported. New
+add-on hardware designs should not rely on this "legacy" feature.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c    |  15 ++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h    |   8 +
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c | 191 ++++++++++++++---------
+ 3 files changed, 143 insertions(+), 71 deletions(-)
+
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+@@ -292,6 +292,7 @@ static int rp1dpi_platform_probe(struct
+ 	struct device *dev = &pdev->dev;
+ 	struct rp1_dpi *dpi;
+ 	struct drm_bridge *bridge = NULL;
++	const char *rgb_order = NULL;
+ 	struct drm_panel *panel;
+ 	int i, j, ret;
+ 
+@@ -353,6 +354,20 @@ static int rp1dpi_platform_probe(struct
+ 	if (ret)
+ 		goto done_err;
+ 
++	dpi->rgb_order_override = RP1DPI_ORDER_UNCHANGED;
++	if (!of_property_read_string(dev->of_node, "rgb_order", &rgb_order)) {
++		if (!strcmp(rgb_order, "rgb"))
++			dpi->rgb_order_override = RP1DPI_ORDER_RGB;
++		else if (!strcmp(rgb_order, "bgr"))
++			dpi->rgb_order_override = RP1DPI_ORDER_BGR;
++		else if (!strcmp(rgb_order, "grb"))
++			dpi->rgb_order_override = RP1DPI_ORDER_GRB;
++		else if (!strcmp(rgb_order, "brg"))
++			dpi->rgb_order_override = RP1DPI_ORDER_BRG;
++		else
++			DRM_ERROR("Invalid dpi order %s - ignored\n", rgb_order);
++	}
++
+ 	/* Check if PIO can snoop on or override DPI's GPIO1 */
+ 	dpi->gpio1_used = false;
+ 	for (i = 0; !dpi->gpio1_used; i++) {
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
+@@ -25,6 +25,13 @@
+ #define RP1DPI_CLK_PLLCORE  2
+ #define RP1DPI_NUM_CLOCKS   3
+ 
++/* Codes (in LE byte order) used for S/W permutation */
++#define RP1DPI_ORDER_UNCHANGED 0
++#define RP1DPI_ORDER_RGB       0x020100
++#define RP1DPI_ORDER_BGR       0x000102
++#define RP1DPI_ORDER_GRB       0x020001
++#define RP1DPI_ORDER_BRG       0x010002
++
+ /* ---------------------------------------------------------------------- */
+ 
+ struct rp1_dpi {
+@@ -45,6 +52,7 @@ struct rp1_dpi {
+ 	u32 bus_fmt;
+ 	bool de_inv, clk_inv;
+ 	bool dpi_running, pipe_enabled;
++	unsigned int rgb_order_override;
+ 	struct completion finished;
+ 
+ 	/* Experimental stuff for interlace follows */
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
+@@ -223,12 +223,90 @@ int rp1dpi_hw_busy(struct rp1_dpi *dpi)
+ 	return (rp1dpi_hw_read(dpi, DPI_DMA_STATUS) & 0xF8F) ? 1 : 0;
+ }
+ 
+-/* Table of supported input (in-memory/DMA) pixel formats. */
++/*
++ * Table of supported input (in-memory/DMA) pixel formats.
++ *
++ * RP1 DPI describes RGB components in terms of their MS bit position, a 10-bit
++ * left-aligned bit-mask, and an optional right-shift-and-OR used for scaling.
++ * To make it easier to permute R, G and B components, we re-pack these fields
++ * into 32-bit code-words, which don't themselves correspond to any register.
++ */
++
++#define RGB_CODE(scale, shift, mask) (((scale) << 24) | ((shift) << 16) | (mask))
++#define RGB_SCALE(c) ((c) >> 24)
++#define RGB_SHIFT(c) (((c) >> 16) & 31)
++#define RGB_MASK(c) ((c) & 0x3ff)
++
+ struct rp1dpi_ipixfmt {
+-	u32 format; /* DRM format code                           */
+-	u32 mask;   /* RGB masks (10 bits each, left justified)  */
+-	u32 shift;  /* RGB MSB positions in the memory word      */
+-	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)   */
++	u32 format;       /* DRM format code                          */
++	u32 rgb_code[3];  /* (width&7), MS bit position, 10-bit mask  */
++	u32 bpp;          /* Bytes per pixel minus one                */
++};
++
++static const struct rp1dpi_ipixfmt my_formats[] = {
++	{
++		.format = DRM_FORMAT_XRGB8888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_XBGR8888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_ARGB8888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_ABGR8888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_RGB888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 2,
++	},
++	{
++		.format = DRM_FORMAT_BGR888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 2,
++	},
++	{
++		.format = DRM_FORMAT_RGB565,
++		.rgb_code = {
++			RGB_CODE(5, 15, 0x3e0),
++			RGB_CODE(6, 10, 0x3f0),
++			RGB_CODE(5, 4, 0x3e0),
++		},
++		.bpp = 1,
++	},
+ };
+ 
+ #define IMASK_RGB(r, g, b)  (FIELD_PREP_CONST(DPI_DMA_IMASK_R_MASK, r)  | \
+@@ -244,63 +322,13 @@ struct rp1dpi_ipixfmt {
+ 			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OG_MASK, g) | \
+ 			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OB_MASK, b))
+ 
+-static const struct rp1dpi_ipixfmt my_formats[] = {
+-	{
+-	  .format = DRM_FORMAT_XRGB8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_XBGR8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_ARGB8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_ABGR8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_RGB888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+-	},
+-	{
+-	  .format = DRM_FORMAT_BGR888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+-	},
+-	{
+-	  .format = DRM_FORMAT_RGB565,
+-	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+-	  .shift  = ISHIFT_RGB(15, 10, 4),
+-	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+-	},
+-	{
+-	  .format = DRM_FORMAT_BGR565,
+-	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+-	  .shift  = ISHIFT_RGB(4, 10, 15),
+-	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+-	}
+-};
+-
++/*
++ * Function to update *shift with output positions, and return output RGB masks.
++ * By the time we get here, RGB order has been normalized to RGB (R most significant).
++ * Note that an internal bus is 30 bits wide: bits [21:20], [11:10], [1:0] are dropped.
++ * This makes the packed RGB5656 and RGB666 formats problematic, as colour components
++ * need to straddle the gaps; we mitigate this by hijacking input masks and scaling.
++ */
+ static u32 set_output_format(u32 bus_format, u32 *shift, u32 *imask, u32 *rgbsz)
+ {
+ 	switch (bus_format) {
+@@ -308,6 +336,7 @@ static u32 set_output_format(u32 bus_for
+ 		if (*shift == ISHIFT_RGB(15, 10, 4)) {
+ 			/* When framebuffer is RGB565, we can output RGB565 */
+ 			*shift = ISHIFT_RGB(15, 7, 0) | OSHIFT_RGB(19, 9, 0);
++			*imask = IMASK_RGB(0x3fc, 0x3fc, 0);
+ 			*rgbsz &= DPI_DMA_RGBSZ_BPP_MASK;
+ 			return OMASK_RGB(0x3fc, 0x3fc, 0);
+ 		}
+@@ -322,7 +351,7 @@ static u32 set_output_format(u32 bus_for
+ 	case MEDIA_BUS_FMT_BGR666_1X18:
+ 		/* due to a HW limitation, bit-depth is effectively RGB444 */
+ 		*shift |= OSHIFT_RGB(23, 15, 7);
+-		*imask &= IMASK_RGB(0x3c0, 0x3c0, 0x3c0);
++		*imask = IMASK_RGB(0x3c0, 0x3c0, 0x3c0);
+ 		*rgbsz = BITS(DPI_DMA_RGBSZ_R, 2) | (*rgbsz & DPI_DMA_RGBSZ_BPP_MASK);
+ 		return OMASK_RGB(0x330, 0x3c0, 0x3c0);
+ 
+@@ -359,7 +388,8 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		    struct drm_display_mode const *mode)
+ {
+ 	u32 shift, imask, omask, rgbsz, vctrl;
+-	int i;
++	u32 rgb_code[3];
++	int order, i;
+ 
+ 	drm_info(&dpi->drm,
+ 		 "in_fmt=\'%c%c%c%c\' bus_fmt=0x%x mode=%dx%d total=%dx%d%s %dkHz %cH%cV%cD%cC",
+@@ -373,26 +403,45 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		 de_inv ? '-' : '+',
+ 		 dpi->clk_inv ? '-' : '+');
+ 
+-	/*
+-	 * Configure all DPI/DMA block registers, except base address.
+-	 * DMA will not actually start until a FB base address is specified
+-	 * using rp1dpi_hw_update().
+-	 */
++	/* Look up the input (in-memory) pixel format */
+ 	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
+ 		if (my_formats[i].format == in_format)
+ 			break;
+ 	}
+ 	if (i >= ARRAY_SIZE(my_formats)) {
+ 		pr_err("%s: bad input format\n", __func__);
+-		i = 4;
++		i = ARRAY_SIZE(my_formats) - 1;
+ 	}
+-	if (BUS_FMT_IS_BGR(bus_format))
+-		i ^= 1;
+-	shift = my_formats[i].shift;
+-	imask = my_formats[i].mask;
+-	rgbsz = my_formats[i].rgbsz;
++
++	/*
++	 * Although these RGB orderings refer to the output (DPI bus) format,
++	 * here we permute the *input* components. After this point, "Red"
++	 * will be most significant (highest numbered GPIOs), regardless
++	 * of rgb_order or bus_format. This simplifies later workarounds.
++	 */
++	order = dpi->rgb_order_override;
++	if (order == RP1DPI_ORDER_UNCHANGED)
++		order = BUS_FMT_IS_BGR(bus_format) ? RP1DPI_ORDER_BGR : RP1DPI_ORDER_RGB;
++	rgb_code[0] = my_formats[i].rgb_code[order & 3];
++	rgb_code[1] = my_formats[i].rgb_code[(order >> 8) & 3];
++	rgb_code[2] = my_formats[i].rgb_code[(order >> 16) & 3];
++	rgbsz = FIELD_PREP(DPI_DMA_RGBSZ_BPP_MASK, my_formats[i].bpp) |
++		FIELD_PREP(DPI_DMA_RGBSZ_R_MASK, RGB_SCALE(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_RGBSZ_G_MASK, RGB_SCALE(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_RGBSZ_B_MASK, RGB_SCALE(rgb_code[2]));
++	shift = FIELD_PREP(DPI_DMA_SHIFT_IR_MASK, RGB_SHIFT(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_SHIFT_IG_MASK, RGB_SHIFT(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_SHIFT_IB_MASK, RGB_SHIFT(rgb_code[2]));
++	imask = FIELD_PREP(DPI_DMA_IMASK_R_MASK, RGB_MASK(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_IMASK_G_MASK, RGB_MASK(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_IMASK_B_MASK, RGB_MASK(rgb_code[2]));
+ 	omask = set_output_format(bus_format, &shift, &imask, &rgbsz);
+ 
++	/*
++	 * Configure all DPI/DMA block registers, except base address.
++	 * DMA will not actually start until a FB base address is specified
++	 * using rp1dpi_hw_update().
++	 */
+ 	rp1dpi_hw_write(dpi, DPI_DMA_IMASK, imask);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_OMASK, omask);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_SHIFT, shift);

target/linux/bcm27xx/patches-6.6/950-1522-add-ina238-to-i2c-sensors.patch

@@ -0,0 +1,102 @@
+From 94de19285cc9bd781394bf1aa4fb8d401aac5195 Mon Sep 17 00:00:00 2001
+From: James Sarrett <jsarrett@gmail.com>
+Date: Sun, 26 Jan 2025 11:29:31 -0800
+Subject: [PATCH] add ina238 to i2c-sensors
+
+This patch adds the ina238 device tree parameters to the i2c-sensors
+overlay.  The ina238 driver needs 2 configuration parameters, shut_resistor
+and ti,shunt-gain in addition to it's address, so they are added as well.
+---
+ arch/arm/boot/dts/overlays/README             | 13 ++++++++++
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 26 ++++++++++++++++++-
+ 2 files changed, 38 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2486,11 +2486,20 @@ Params: addr                    Set the
+         ds1621                  Select the Dallas Semiconductors DS1621 temp
+                                 sensor. Valid addresses 0x48-0x4f, default 0x48
+ 
++        gain                    Gain used for measuring shunt resistor current.
++                                Valid values 1 or 4, default 1. (ina238 only,
++                                disabled by default)
++
+         hdc100x                 Select the Texas Instruments HDC100x temp sensor
+                                 Valid addresses 0x40-0x43, default 0x40
+ 
+         htu21                   Select the HTU21 temperature and humidity sensor
+ 
++        ina238                  Select the TI INA238 power monitor. Valid
++                                addresses 0x40-0x4F, default 0x40.
++                                Uses parameters shunt-resistor and
++                                ti,shunt-gain for configuration
++
+         int_pin                 Set the GPIO to use for interrupts (max30102,
+                                 mpu6050 and mpu9250 only)
+ 
+@@ -2549,6 +2558,10 @@ Params: addr                    Set the
+         reset_pin               GPIO to be used to reset the device (bno055
+                                 only, disabled by default)
+ 
++        shunt_resistor          Value of shunt resistor used for current
++                                measurement in uOhms.  (ina238 only, disabled
++                                by default)
++
+         sht3x                   Select the Sensirion SHT3x temperature and
+                                 humidity sensors. Valid addresses 0x44-0x45,
+                                 default 0x44
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -526,6 +526,27 @@
+ 		};
+ 	};
+ 
++	fragment@35 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ina238: ina238@48 {
++				compatible = "ti,ina238";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				reg = <0x40>;
++				/* uOhms, uint32_t */
++				shunt-resistor = <1000>;
++				/* 1 or 4, (±40.96 mV or ±163.84 mV) */
++				ti,shunt-gain = <1>;
++				status = "okay";
++			};
++		};
++	};
++
+ 	fragment@99 {
+ 		target = <&gpio>;
+ 		__dormant__ {
+@@ -573,6 +594,7 @@
+ 		bno055 = <0>,"+31";
+ 		sht4x = <0>,"+32";
+ 		adt7410 = <0>,"+34";
++		ina238 = <0>,"+35";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+@@ -582,7 +604,7 @@
+ 			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
+ 			<&mpu6050>,"reg:0", <&mpu9250>,"reg:0",
+ 			<&bno055>,"reg:0", <&sht4x>,"reg:0",
+-			<&bmp380>,"reg:0", <&adt7410>,"reg:0";
++			<&bmp380>,"reg:0", <&adt7410>,"reg:0", <&ina238>,"reg:0";
+ 		int_pin = <&int_pins>, "brcm,pins:0",
+ 			<&int_pins>, "reg:0",
+ 			<&max30102>, "interrupts:0",
+@@ -590,5 +612,7 @@
+ 			<&mpu9250>, "interrupts:0";
+ 		no_timeout = <&jc42>, "smbus-timeout-disable?";
+ 		reset_pin = <&bno055>,"reset-gpios:4", <0>,"+30";
++		shunt_resistor = <&ina238>,"shunt-resistor:0";
++		gain = <&ina238>,"ti,shunt-gain:0";
+ 	};
+ };

target/linux/bcm27xx/patches-6.6/950-1524-add-shtc3-to-i2c-sensors.patch

@@ -0,0 +1,57 @@
+From aabe16b3cdc6172618803ed7a6002d1099d306e5 Mon Sep 17 00:00:00 2001
+From: James Sarrett <jsarrett@gmail.com>
+Date: Sun, 26 Jan 2025 22:07:02 -0800
+Subject: [PATCH] add shtc3 to i2c-sensors
+
+This patch adds the shtc3 device tree parameters to the i2c-sensors
+overlay.  The shtc3 driver needs no other configuration parameters, as the
+i2c address is permanently baked in to the silicon.
+---
+ arch/arm/boot/dts/overlays/README                |  3 +++
+ .../arm/boot/dts/overlays/i2c-sensor-common.dtsi | 16 ++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2570,6 +2570,9 @@ Params: addr                    Set the
+                                 humidity sensors. Valid addresses 0x44-0x45,
+                                 default 0x44
+ 
++        shtc3                   Select the Sensirion SHTC3 temperature and
++                                humidity sensors.
++
+         si7020                  Select the Silicon Labs Si7013/20/21 humidity/
+                                 temperature sensor
+ 
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -547,6 +547,21 @@
+ 		};
+ 	};
+ 
++	fragment@36 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			shtc3: shtc3@70 {
++				compatible = "sensirion,shtc3";
++				reg = <0x70>;
++				status = "okay";
++			};
++		};
++	};
++
+ 	fragment@99 {
+ 		target = <&gpio>;
+ 		__dormant__ {
+@@ -595,6 +610,7 @@
+ 		sht4x = <0>,"+32";
+ 		adt7410 = <0>,"+34";
+ 		ina238 = <0>,"+35";
++		shtc3 = <0>,"+36";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",

target/linux/bcm27xx/patches-6.6/950-1526-overlays-Regularisation-and-improvements.patch

@@ -0,0 +1,139 @@
+From fa71765fd3c98fa170407e72e052004913da6874 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 27 Jan 2025 14:17:46 +0000
+Subject: [PATCH] overlays: Regularisation and improvements
+
+A few small improvements, with a view to making the updated overlays
+behave the same before and after the big conversion.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/ads1115-overlay.dts       | 3 ++-
+ arch/arm/boot/dts/overlays/i2c-fan-overlay.dts       | 4 ++--
+ arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts       | 3 ++-
+ arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts    | 3 ++-
+ arch/arm/boot/dts/overlays/mcp23017-overlay.dts      | 3 ++-
+ arch/arm/boot/dts/overlays/pca953x-overlay.dts       | 2 --
+ arch/arm/boot/dts/overlays/pcf857x-overlay.dts       | 2 +-
+ arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts | 2 +-
+ arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts | 2 +-
+ 9 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -120,7 +120,8 @@
+ 		chd_cfg =         <&channel_d>,"reg:0";
+ 		chd_gain =        <&channel_d>,"ti,gain:0";
+ 		chd_datarate =    <&channel_d>,"ti,datarate:0";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -17,7 +17,6 @@
+ 			emc2301: emc2301@2f {
+ 				compatible = "microchip,emc2301";
+ 				reg = <0x2f>;
+-				status = "okay";
+ 				#cooling-cells = <0x02>;
+ 			};
+ 		};
+@@ -82,7 +81,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 =		<&frag100>,"target:0=",<&i2c0>;
++		i2c0 =		<&frag100>,"target:0=",<&i2c0>,
++				<0>,"+101+102";
+ 		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
+ 				<0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -27,7 +27,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -27,7 +27,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -87,7 +87,8 @@
+ 		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
+ 		mcp23008 = <0>,"=2";
+ 		noints = <0>,"!1!3";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -17,8 +17,6 @@
+ 				reg = <0x20>;
+ 				gpio-controller;
+ 				#gpio-cells = <2>;
+-
+-				status = "okay";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -11,13 +11,13 @@
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			status = "okay";
+ 
+ 			pcf857x: pcf857x@0 {
+ 				compatible = "";
+ 				reg = <0x00>;
+ 				gpio-controller;
+ 				#gpio-cells = <2>;
+-				status = "okay";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -27,7 +27,7 @@
+ 	};
+ 
+ 	fragment@1 {
+-		target-path = "/";
++		target = <&clocks>;
+ 		__overlay__ {
+ 			sc16is750_clk: sc16is750_i2c_clk@48 {
+ 				compatible = "fixed-clock";
+--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -27,7 +27,7 @@
+ 	};
+ 
+ 	fragment@1 {
+-		target-path = "/";
++		target = <&clocks>;
+ 		__overlay__ {
+ 			sc16is752_clk: sc16is752_i2c_clk@48 {
+ 				compatible = "fixed-clock";

target/linux/bcm27xx/patches-6.6/950-1529-misc-rp1-pio-SM_CONFIG_XFER32-larger-DMA-bufs.patch

@@ -0,0 +1,63 @@
+From 8a08b4ad6dbd48a826b3052e52a4fdc88c3ac36e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 30 Jan 2025 15:26:39 +0000
+Subject: [PATCH] misc: rp1-pio: SM_CONFIG_XFER32 = larger DMA bufs
+
+Add an ioctl type - SM_CONFIG_XFER32 - that takes uints for the buf_size
+and buf_count values.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c         | 9 +++++++++
+ include/uapi/misc/rp1_pio_if.h | 8 ++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -710,6 +710,14 @@ static int rp1_pio_sm_config_xfer_user(s
+ 					       args->buf_size, args->buf_count);
+ }
+ 
++static int rp1_pio_sm_config_xfer32_user(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_config_xfer32_args *args = param;
++
++	return rp1_pio_sm_config_xfer_internal(client, args->sm, args->dir,
++					       args->buf_size, args->buf_count);
++}
++
+ static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
+ 				  const void __user *userbuf, size_t bytes)
+ {
+@@ -970,6 +978,7 @@ struct handler_info {
+ 	HANDLER(SM_CONFIG_XFER, sm_config_xfer_user),
+ 	HANDLER(SM_XFER_DATA, sm_xfer_data_user),
+ 	HANDLER(SM_XFER_DATA32, sm_xfer_data32_user),
++	HANDLER(SM_CONFIG_XFER32, sm_config_xfer32_user),
+ 
+ 	HANDLER(CAN_ADD_PROGRAM, can_add_program),
+ 	HANDLER(ADD_PROGRAM, add_program),
+--- a/include/uapi/misc/rp1_pio_if.h
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -160,6 +160,13 @@ struct rp1_pio_sm_config_xfer_args {
+ 	uint16_t buf_count;
+ };
+ 
++struct rp1_pio_sm_config_xfer32_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint32_t buf_size;
++	uint32_t buf_count;
++};
++
+ struct rp1_pio_sm_xfer_data_args {
+ 	uint16_t sm;
+ 	uint16_t dir;
+@@ -185,6 +192,7 @@ struct rp1_access_hw_args {
+ #define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
+ #define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
+ #define PIO_IOC_SM_XFER_DATA32 _IOW(PIO_IOC_MAGIC, 2, struct rp1_pio_sm_xfer_data32_args)
++#define PIO_IOC_SM_CONFIG_XFER32 _IOW(PIO_IOC_MAGIC, 3, struct rp1_pio_sm_config_xfer32_args)
+ 
+ #define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
+ #define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)

target/linux/bcm27xx/patches-6.6/950-1530-spi-dw-Wait-for-idle-after-TX.patch

@@ -0,0 +1,29 @@
+From 54a442deb925c37346abbbcc566234757925910c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 17:50:20 +0000
+Subject: [PATCH] spi: dw: Wait for idle after TX
+
+If this is a DMA transfer, and if there is no simultaneous RX transfer,
+wait for the interface to go idle before reporting that TX is done.
+
+Link: https://forums.raspberrypi.com/viewtopic.php?t=383027
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-dma.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -304,6 +304,11 @@ static int dw_spi_dma_wait_tx_done(struc
+ 		return -EIO;
+ 	}
+ 
++	if (!xfer->rx_buf) {
++		while (dw_readl(dws, DW_SPI_SR) & DW_SPI_SR_BUSY)
++			cpu_relax();
++	}
++
+ 	return 0;
+ }
+ 

target/linux/bcm27xx/patches-6.6/950-1531-misc-rp1-pio-Error-out-on-incompatible-firmware.patch

@@ -0,0 +1,42 @@
+From e0a21a407b78477aa530800255d53405950cb1fb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 14:44:08 +0000
+Subject: [PATCH] misc: rp1-pio: Error out on incompatible firmware
+
+If the RP1 firmware has reported an error then return that from the PIO
+probe function, otherwise defer the probing.
+
+Link: https://github.com/raspberrypi/linux/issues/6642
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1277,8 +1277,10 @@ static int rp1_pio_probe(struct platform
+ 		return dev_err_probe(dev, pdev->id, "alias is missing\n");
+ 
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+-	if (IS_ERR_OR_NULL(fw))
+-		return dev_err_probe(dev, -ENOENT, "failed to contact RP1 firmware\n");
++	if (!fw)
++		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find RP1 firmware driver\n");
++	if (IS_ERR(fw))
++		return dev_err_probe(dev, PTR_ERR(fw), "failed to contact RP1 firmware\n");
+ 	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
+ 	if (ret < 0)
+ 		return ret;
+@@ -1355,6 +1357,11 @@ static void rp1_pio_remove(struct platfo
+ 
+ 	if (g_pio == pio)
+ 		g_pio = NULL;
++
++	device_destroy(pio->dev_class, pio->dev_num);
++	cdev_del(&pio->cdev);
++	class_destroy(pio->dev_class);
++	unregister_chrdev_region(pio->dev_num, 1);
+ }
+ 
+ static const struct of_device_id rp1_pio_ids[] = {

target/linux/bcm27xx/patches-6.6/950-1532-firmware-rp1-Linger-on-firmware-failure.patch

@@ -0,0 +1,103 @@
+From 3f60adc5ce8238996ec43d2b76a6e38e46f8271b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 14:51:52 +0000
+Subject: [PATCH] firmware: rp1: Linger on firmware failure
+
+To avoid pointless retries, let the probe function succeed if the
+firmware interface is configured correctly but the firmware is
+incompatible. The value of the private drvdata field holds the outcome.
+
+Link: https://github.com/raspberrypi/linux/issues/6642
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/rp1.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/firmware/rp1.c
++++ b/drivers/firmware/rp1.c
+@@ -114,7 +114,8 @@ static void rp1_firmware_delete(struct k
+ 
+ void rp1_firmware_put(struct rp1_firmware *fw)
+ {
+-	kref_put(&fw->consumers, rp1_firmware_delete);
++	if (!IS_ERR_OR_NULL(fw))
++		kref_put(&fw->consumers, rp1_firmware_delete);
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_put);
+ 
+@@ -157,7 +158,7 @@ struct rp1_firmware *rp1_firmware_get(st
+ 	const char *match = rp1_firmware_of_match[0].compatible;
+ 	struct platform_device *pdev;
+ 	struct device_node *fwnode;
+-	struct rp1_firmware *fw;
++	struct rp1_firmware *fw = NULL;
+ 
+ 	if (!client)
+ 		return NULL;
+@@ -166,17 +167,17 @@ struct rp1_firmware *rp1_firmware_get(st
+ 		return NULL;
+ 	if (!of_device_is_compatible(fwnode, match)) {
+ 		of_node_put(fwnode);
+-		return NULL;
++		return ERR_PTR(-ENXIO);
+ 	}
+ 
+ 	pdev = of_find_device_by_node(fwnode);
+ 	of_node_put(fwnode);
+ 
+ 	if (!pdev)
+-		goto err_exit;
++		return ERR_PTR(-ENXIO);
+ 
+ 	fw = platform_get_drvdata(pdev);
+-	if (!fw)
++	if (IS_ERR_OR_NULL(fw))
+ 		goto err_exit;
+ 
+ 	if (!kref_get_unless_zero(&fw->consumers))
+@@ -188,7 +189,7 @@ struct rp1_firmware *rp1_firmware_get(st
+ 
+ err_exit:
+ 	put_device(&pdev->dev);
+-	return NULL;
++	return fw;
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_get);
+ 
+@@ -204,8 +205,8 @@ struct rp1_firmware *devm_rp1_firmware_g
+ 	int ret;
+ 
+ 	fw = rp1_firmware_get(client);
+-	if (!fw)
+-		return NULL;
++	if (IS_ERR_OR_NULL(fw))
++		return fw;
+ 
+ 	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
+ 	if (ret)
+@@ -270,19 +271,18 @@ static int rp1_firmware_probe(struct pla
+ 	init_completion(&fw->c);
+ 	kref_init(&fw->consumers);
+ 
+-	platform_set_drvdata(pdev, fw);
+-
+ 	ret = rp1_firmware_message(fw, GET_FIRMWARE_VERSION,
+ 				   NULL, 0, &version, sizeof(version));
+ 	if (ret == sizeof(version)) {
+ 		dev_info(dev, "RP1 Firmware version %08x%08x%08x%08x%08x\n",
+ 			 version[0], version[1], version[2], version[3], version[4]);
+-		ret = 0;
+-	} else if (ret >= 0) {
+-		ret = -EIO;
++		platform_set_drvdata(pdev, fw);
++	} else {
++		rp1_firmware_put(fw);
++		platform_set_drvdata(pdev, ERR_PTR(-ENOENT));
+ 	}
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static int rp1_firmware_remove(struct platform_device *pdev)

target/linux/bcm27xx/patches-6.6/950-1533-mailbox-rp1-Don-t-claim-channels-in-of_xlate.patch

@@ -0,0 +1,30 @@
+From 4d577c42b47dfffda80da995fafd5b16fdb242e2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 4 Feb 2025 13:18:45 +0000
+Subject: [PATCH] mailbox: rp1: Don't claim channels in of_xlate
+
+The of_xlate method saves the calculated event mask in the con_priv
+field. It also rejects subsequent attempt to use that channel because
+the mask is non-zero, which causes a repeated instantiation of a client
+driver to fail.
+
+The of_xlate method is not meant to be a point of resource acquisition.
+Leave the con_priv initialisation, but drop the test that it was
+previously zero.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mailbox/rp1-mailbox.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/mailbox/rp1-mailbox.c
++++ b/drivers/mailbox/rp1-mailbox.c
+@@ -133,8 +133,6 @@ static struct mbox_chan *rp1_mbox_xlate(
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	chan = &mbox->chans[doorbell];
+-	if (chan->con_priv)
+-		return ERR_PTR(-EBUSY);
+ 
+ 	chan->con_priv = (void *)(uintptr_t)(1 << doorbell);
+