diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
new file mode 100644
index 0000000000..bf918fe562
--- /dev/null
+++ b/.github/workflows/packages.yml
@@ -0,0 +1,151 @@
+name: Build all core packages
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/packages.yml'
+      - 'config/**'
+      - 'include/**'
+      - 'package/**'
+      - 'target/linux/generic/**'
+      - 'toolchain/**'
+  push:
+    paths:
+      - '.github/workflows/packages.yml'
+      - 'config/**'
+      - 'include/**'
+      - 'package/**'
+      - 'target/linux/generic/**'
+      - 'toolchain/**'
+
+permissions:
+  contents: read
+
+jobs:
+  setup_build:
+    name: Setup build
+    runs-on: ubuntu-latest
+    outputs:
+      owner_lc: ${{ steps.lower_owner.outputs.owner_lc }}
+
+    steps:
+      - name: Set lower case owner name
+        id: lower_owner
+        run: |
+          OWNER_LC=$(echo "${{ github.repository_owner }}" \
+            | tr '[:upper:]' '[:lower:]')
+          echo "owner_lc=$OWNER_LC" >> $GITHUB_OUTPUT
+
+  build:
+    name: Build all core packages
+    needs: setup_build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: False
+      matrix:
+        include:
+          - name: malta-be
+            target: malta
+            subtarget: be
+          - name: x86-64
+            target: x86
+            subtarget: 64
+
+    container: ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:latest
+
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Checkout master directory
+        uses: actions/checkout@v3
+        with:
+          path: openwrt
+
+      - name: Fix permission
+        run: |
+          chown -R buildbot:buildbot openwrt
+
+      - name: Initialization environment
+        run: |
+          TARGET=$(echo ${{ matrix.target }})
+          SUBTARGET=$(echo ${{ matrix.subtarget }})
+          echo "TARGET=$TARGET" >> "$GITHUB_ENV"
+          echo "SUBTARGET=$SUBTARGET" >> "$GITHUB_ENV"
+
+      - name: Parse toolchain file
+        working-directory: openwrt
+        run: |
+          TOOLCHAIN_STRING="$(curl "https://downloads.cdn.openwrt.org/snapshots/targets/${{ env.TARGET }}/${{ env.SUBTARGET }}/sha256sums" \
+            | grep ".*openwrt-toolchain.*tar.xz")"
+          TOOLCHAIN_FILE=$(echo "$TOOLCHAIN_STRING" | sed -n -e 's/.*\(openwrt-toolchain.*\).tar.xz/\1/p')
+          TOOLCHAIN_SHA256=$(echo "$TOOLCHAIN_STRING" | cut -d ' ' -f 1)
+
+          echo "TOOLCHAIN_FILE=$TOOLCHAIN_FILE" >> "$GITHUB_ENV"
+          echo "TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256" >> "$GITHUB_ENV"
+
+      - name: Cache external toolchain
+        id: cache-external-toolchain
+        uses: actions/cache@v3
+        with:
+          path: openwrt/${{ env.TOOLCHAIN_FILE }}
+          key: ${{ env.TOOLCHAIN_FILE }}-${{ env.TOOLCHAIN_SHA256 }}
+
+      - name: Download external toolchain
+        if: ${{ steps.cache-external-toolchain.outputs.cache-hit != 'true' }}
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: |
+          wget -O - https://downloads.cdn.openwrt.org/snapshots/targets/${{ env.TARGET }}/${{ env.SUBTARGET }}/${TOOLCHAIN_FILE}.tar.xz \
+            | tar --xz -xf -
+
+      - name: Extract prebuilt tools
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: ./scripts/ext-tools.sh --tools /tools.tar
+
+      - name: Create configuration
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: |
+          echo CONFIG_ALL=y >> .config
+          echo CONFIG_ALL_KMODS=y >> .config
+          echo CONFIG_ALL_NONSHARED=y >> .config
+
+          ./scripts/ext-toolchain.sh \
+            --toolchain ${{ env.TOOLCHAIN_FILE }}/toolchain-* \
+            --overwrite-config \
+            --config ${{ env.TARGET }}/${{ env.SUBTARGET }}
+
+      - name: Show configuration
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: ./scripts/diffconfig.sh
+
+      - name: Build tools
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: make tools/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+      - name: Build toolchain
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: make toolchain/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+      - name: Build Kernel
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: make target/compile -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+      - name: Build everything
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: make -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+      - name: Upload logs
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ env.TARGET }}-${{ env.SUBTARGET }}-logs
+          path: "openwrt/logs"
diff --git a/include/bpf.mk b/include/bpf.mk
index 7d0cfbd76d..e43fcad50c 100644
--- a/include/bpf.mk
+++ b/include/bpf.mk
@@ -63,6 +63,7 @@ BPF_CFLAGS := \
 	-Wno-unused-label \
 	-O2 -emit-llvm -Xclang -disable-llvm-passes
 
+ifneq ($(CONFIG_HAS_BPF_TOOLCHAIN),)
 ifeq ($(DUMP),)
   CLANG_VER:=$(shell $(CLANG) -dM -E - < /dev/null | grep __clang_major__ | cut -d' ' -f3)
   CLANG_VER_VALID:=$(shell [ "$(CLANG_VER)" -ge "$(CLANG_MIN_VER)" ] && echo 1 )
@@ -70,6 +71,7 @@ ifeq ($(DUMP),)
     $(error ERROR: LLVM/clang version too old. Minimum required: $(CLANG_MIN_VER), found: $(CLANG_VER))
   endif
 endif
+endif
 
 define CompileBPF
 	$(CLANG) -g -target $(BPF_ARCH)-linux-gnu $(BPF_CFLAGS) $(2) \
diff --git a/include/kernel-5.10 b/include/kernel-5.10
index 3824c3bfec..f4cdfe5faa 100644
--- a/include/kernel-5.10
+++ b/include/kernel-5.10
@@ -1,2 +1,2 @@
-LINUX_VERSION-5.10 = .149
-LINUX_KERNEL_HASH-5.10.149 = 0f6134c537563b9cd0533924e3ce06f577cf874e7a00cf3d8e8b31222ac065d3
+LINUX_VERSION-5.10 = .152
+LINUX_KERNEL_HASH-5.10.152 = fa0b5c83a4ebfda9f0a52cc693646eb6c24dbade6c37ee2d18b66ee2df15d8a6
diff --git a/include/kernel-5.15 b/include/kernel-5.15
index bd2e9f1dd3..dc199a6566 100644
--- a/include/kernel-5.15
+++ b/include/kernel-5.15
@@ -1,2 +1,2 @@
-LINUX_VERSION-5.15 = .74
-LINUX_KERNEL_HASH-5.15.74 = 2c1539a2f85b835c36c4a07c8270b52b0bec38fdda7339477d07f0c3af8c4265
+LINUX_VERSION-5.15 = .76
+LINUX_KERNEL_HASH-5.15.76 = 9007a020c419e3625b980e361be09f70ebd99e156ccb66129a981483d065d57f
diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
index c9960bf9d4..1019b9927c 100644
--- a/package/base-files/files/lib/upgrade/nand.sh
+++ b/package/base-files/files/lib/upgrade/nand.sh
@@ -56,11 +56,11 @@ nand_find_ubi() {
 }
 
 nand_get_magic_long() {
-	dd if="$1" skip=$2 bs=4 count=1 2>/dev/null | hexdump -v -n 4 -e '1/1 "%02x"'
+	(${3}cat "$1" | dd bs=4 "skip=${2:-0}" count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
 }
 
 get_magic_long_tar() {
-	( tar xf $1 $2 -O | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
+	(tar xO${3}f "$1" "$2" | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
 }
 
 identify_magic() {
@@ -81,6 +81,9 @@ identify_magic() {
 		"4349"*)
 			echo "combined"
 			;;
+		"1f8b"*)
+			echo "gzip"
+			;;
 		*)
 			echo "unknown $magic"
 			;;
@@ -89,11 +92,15 @@ identify_magic() {
 
 
 identify() {
-	identify_magic $(nand_get_magic_long "$1" "${2:-0}")
+	identify_magic $(nand_get_magic_long "$@")
 }
 
 identify_tar() {
-	identify_magic $(get_magic_long_tar "$1" "$2")
+	identify_magic $(get_magic_long_tar "$@")
+}
+
+identify_if_gzip() {
+	if [ "$(identify "$1")" = gzip ]; then echo -n z; fi
 }
 
 nand_restore_config() {
@@ -127,21 +134,45 @@ nand_restore_config() {
 }
 
 nand_remove_ubiblock() {
-	local ubivol=$1
-	local ubiblk=ubiblock${ubivol:3}
-	if [ -e /dev/$ubiblk ]; then
-		echo "removing $ubiblk"
-		if ! ubiblock -r /dev/$ubivol; then
+	local ubivol="$1"
+
+	local ubiblk="ubiblock${ubivol:3}"
+	if [ -e "/dev/$ubiblk" ]; then
+		umount "/dev/$ubiblk" && echo "unmounted /dev/$ubiblk" || :
+		if ! ubiblock -r "/dev/$ubivol"; then
 			echo "cannot remove $ubiblk"
 			return 1
 		fi
 	fi
 }
 
+nand_detach_ubi() {
+	local ubipart="$1"
+
+	local mtdnum="$( find_mtd_index "$ubipart" )"
+	if [ ! "$mtdnum" ]; then
+		echo "cannot find ubi mtd partition $ubipart"
+		return 1
+	fi
+
+	local ubidev="$( nand_find_ubi "$ubipart" )"
+	if [ "$ubidev" ]; then
+		for ubivol in $(find /dev -name "${ubidev}_*" -maxdepth 1 | sort); do
+			ubivol="${ubivol:5}"
+			nand_remove_ubiblock "$ubivol" || :
+			umount "/dev/$ubivol" && echo "unmounted /dev/$ubivol" || :
+		done
+		if ! ubidetach -m "$mtdnum"; then
+			echo "cannot detach ubi mtd partition $ubipart"
+			return 1
+		fi
+	fi
+}
+
 nand_upgrade_prepare_ubi() {
 	local rootfs_length="$1"
 	local rootfs_type="$2"
-	local rootfs_data_max="$(fw_printenv -n rootfs_data_max 2>/dev/null)"
+	local rootfs_data_max="$(fw_printenv -n rootfs_data_max 2> /dev/null)"
 	[ -n "$rootfs_data_max" ] && rootfs_data_max=$((rootfs_data_max))
 
 	local kernel_length="$3"
@@ -231,76 +262,64 @@ nand_upgrade_prepare_ubi() {
 	return 0
 }
 
-nand_do_upgrade_success() {
-	local conf_tar="/tmp/sysupgrade.tgz"
-	if { [ ! -f "$conf_tar" ] || nand_restore_config "$conf_tar"; } && sync; then
-		echo "sysupgrade successful"
-	fi
-	umount -a
-	reboot -f
-}
-
-# Flash the UBI image to MTD partition
+# Write the UBI image to MTD ubi partition
 nand_upgrade_ubinized() {
 	local ubi_file="$1"
-	local mtdnum="$(find_mtd_index "$CI_UBIPART")"
+	local gz="$2"
 
-	if [ ! "$mtdnum" ]; then
-		echo "cannot find mtd device $CI_UBIPART"
-		umount -a
-		reboot -f
-	fi
+	nand_detach_ubi "$CI_UBIPART" || return 1
 
-	local mtddev="/dev/mtd${mtdnum}"
-	ubidetach -p "${mtddev}" || :
-	ubiformat "${mtddev}" -y -f "${ubi_file}"
-	ubiattach -p "${mtddev}"
-
-	nand_do_upgrade_success
+	local mtdnum="$( find_mtd_index "$CI_UBIPART" )"
+	${gz}cat "$ubi_file" | ubiformat "/dev/mtd$mtdnum" -y -f - && ubiattach -m "$mtdnum"
 }
 
-# Write the UBIFS image to UBI volume
+# Write the UBIFS image to UBI rootfs volume
 nand_upgrade_ubifs() {
-	local rootfs_length=$( (cat $1 | wc -c) 2> /dev/null)
+	local ubifs_file="$1"
+	local gz="$2"
 
-	nand_upgrade_prepare_ubi "$rootfs_length" "ubifs" "" ""
+	local ubifs_length=$( (${gz}cat "$ubifs_file" | wc -c) 2> /dev/null)
+
+	nand_upgrade_prepare_ubi "$ubifs_length" "ubifs" "" "" || return 1
 
 	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
 	local root_ubivol="$(nand_find_volume $ubidev "$CI_ROOTPART")"
-	ubiupdatevol /dev/$root_ubivol -s $rootfs_length $1
-
-	nand_do_upgrade_success
+	${gz}cat "$ubifs_file" | ubiupdatevol /dev/$root_ubivol -s "$ubifs_length" -
 }
 
+# Write the FIT image to UBI kernel volume
 nand_upgrade_fit() {
 	local fit_file="$1"
-	local fit_length="$(wc -c < "$fit_file")"
+	local gz="$2"
 
-	nand_upgrade_prepare_ubi "" "" "$fit_length" "1"
+	local fit_length=$( (${gz}cat "$fit_file" | wc -c) 2> /dev/null)
+
+	nand_upgrade_prepare_ubi "" "" "$fit_length" "1" || return 1
 
 	local fit_ubidev="$(nand_find_ubi "$CI_UBIPART")"
 	local fit_ubivol="$(nand_find_volume $fit_ubidev "$CI_KERNPART")"
-	ubiupdatevol /dev/$fit_ubivol -s $fit_length $fit_file
-
-	nand_do_upgrade_success
+	${gz}cat "$fit_file" | ubiupdatevol /dev/$fit_ubivol -s "$fit_length" -
 }
 
+# Write images in the TAR file to MTD partitions and/or UBI volumes as required
 nand_upgrade_tar() {
 	local tar_file="$1"
+	local gz="$2"
 
-	local board_dir="$(tar tf "$tar_file" | grep -m 1 '^sysupgrade-.*/$')"
+	# WARNING: This fails if tar contains more than one 'sysupgrade-*' directory.
+	local board_dir="$(tar t${gz}f "$tar_file" | grep -m 1 '^sysupgrade-.*/$')"
 	board_dir="${board_dir%/}"
 
 	local kernel_mtd kernel_length
 	if [ "$CI_KERNPART" != "none" ]; then
 		kernel_mtd="$(find_mtd_index "$CI_KERNPART")"
-		kernel_length=$( (tar xf "$tar_file" "$board_dir/kernel" -O | wc -c) 2> /dev/null)
+		kernel_length=$( (tar xO${gz}f "$tar_file" "$board_dir/kernel" | wc -c) 2> /dev/null)
 		[ "$kernel_length" = 0 ] && kernel_length=
 	fi
-	local rootfs_length=$( (tar xf "$tar_file" "$board_dir/root" -O | wc -c) 2> /dev/null)
+	local rootfs_length=$( (tar xO${gz}f "$tar_file" "$board_dir/root" | wc -c) 2> /dev/null)
 	[ "$rootfs_length" = 0 ] && rootfs_length=
 	local rootfs_type
-	[ "$rootfs_length" ] && rootfs_type="$(identify_tar "$tar_file" "$board_dir/root")"
+	[ "$rootfs_length" ] && rootfs_type="$(identify_tar "$tar_file" "$board_dir/root" "$gz")"
 
 	local ubi_kernel_length
 	if [ "$kernel_length" ]; then
@@ -308,58 +327,125 @@ nand_upgrade_tar() {
 			# On some devices, the raw kernel and ubi partitions overlap.
 			# These devices brick if the kernel partition is erased.
 			# Hence only invalidate kernel for now.
-			dd if=/dev/zero bs=4096 count=1 2>/dev/null | \
+			dd if=/dev/zero bs=4096 count=1 2> /dev/null | \
 				mtd write - "$CI_KERNPART"
 		else
 			ubi_kernel_length="$kernel_length"
 		fi
 	fi
 	local has_env=0
-	nand_upgrade_prepare_ubi "$rootfs_length" "$rootfs_type" "$ubi_kernel_length" "$has_env"
+	nand_upgrade_prepare_ubi "$rootfs_length" "$rootfs_type" "$ubi_kernel_length" "$has_env" || return 1
 
 	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
 	if [ "$rootfs_length" ]; then
 		local root_ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"
-		tar xf "$tar_file" "$board_dir/root" -O | \
-			ubiupdatevol /dev/$root_ubivol -s $rootfs_length -
+		tar xO${gz}f "$tar_file" "$board_dir/root" | \
+			ubiupdatevol /dev/$root_ubivol -s "$rootfs_length" -
 	fi
 	if [ "$kernel_length" ]; then
 		if [ "$kernel_mtd" ]; then
-			tar xf "$tar_file" "$board_dir/kernel" -O | \
+			tar xO${gz}f "$tar_file" "$board_dir/kernel" | \
 				mtd write - "$CI_KERNPART"
 		else
 			local kern_ubivol="$( nand_find_volume $ubidev "$CI_KERNPART" )"
-			tar xf "$tar_file" "$board_dir/kernel" -O | \
-				ubiupdatevol /dev/$kern_ubivol -s $kernel_length -
+			tar xO${gz}f "$tar_file" "$board_dir/kernel" | \
+				ubiupdatevol /dev/$kern_ubivol -s "$kernel_length" -
 		fi
 	fi
 
-	nand_do_upgrade_success
+	return 0
+}
+
+nand_verify_if_gzip_file() {
+	local file="$1"
+	local gz="$2"
+
+	if [ "$gz" = z ]; then
+		echo "verifying compressed sysupgrade file integrity"
+		if ! gzip -t "$file"; then
+			echo "corrupted compressed sysupgrade file"
+			return 1
+		fi
+	fi
+}
+
+nand_verify_tar_file() {
+	local file="$1"
+	local gz="$2"
+
+	echo "verifying sysupgrade tar file integrity"
+	if ! tar xO${gz}f "$file" > /dev/null; then
+		echo "corrupted sysupgrade tar file"
+		return 1
+	fi
+}
+
+nand_do_flash_file() {
+	local file="$1"
+
+	local gz="$(identify_if_gzip "$file")"
+	local file_type="$(identify "$file" "" "$gz")"
+
+	[ ! "$(find_mtd_index "$CI_UBIPART")" ] && CI_UBIPART=rootfs
+
+	case "$file_type" in
+		"fit")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_fit "$file" "$gz"
+			;;
+		"ubi")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_ubinized "$file" "$gz"
+			;;
+		"ubifs")
+			nand_verify_if_gzip_file "$file" "$gz" || return 1
+			nand_upgrade_ubifs "$file" "$gz"
+			;;
+		*)
+			nand_verify_tar_file "$file" "$gz" || return 1
+			nand_upgrade_tar "$file" "$gz"
+			;;
+	esac
+}
+
+nand_do_restore_config() {
+	local conf_tar="/tmp/sysupgrade.tgz"
+	[ ! -f "$conf_tar" ] || nand_restore_config "$conf_tar"
 }
 
 # Recognize type of passed file and start the upgrade process
 nand_do_upgrade() {
-	local file_type=$(identify "$1")
-
-	[ ! "$(find_mtd_index "$CI_UBIPART")" ] && CI_UBIPART=rootfs
+	local file="$1"
 
 	sync
-	case "$file_type" in
-		"fit")		nand_upgrade_fit "$1";;
-		"ubi")		nand_upgrade_ubinized "$1";;
-		"ubifs")	nand_upgrade_ubifs "$1";;
-		*)		nand_upgrade_tar "$1";;
-	esac
+	nand_do_flash_file "$file" && nand_do_upgrade_success
+	nand_do_upgrade_failed
 }
 
-# Check if passed file is a valid one for NAND sysupgrade. Currently it accepts
-# 3 types of files:
-# 1) UBI - should contain an ubinized image, header is checked for the proper
-#    MAGIC
-# 2) UBIFS - should contain UBIFS partition that will replace "rootfs" volume,
-#    header is checked for the proper MAGIC
-# 3) TAR - archive has to include "sysupgrade-BOARD" directory with a non-empty
-#    "CONTROL" file (at this point its content isn't verified)
+nand_do_upgrade_success() {
+	if nand_do_restore_config && sync; then
+		echo "sysupgrade successful"
+		umount -a
+		reboot -f
+	fi
+	nand_do_upgrade_failed
+}
+
+nand_do_upgrade_failed() {
+	sync
+	echo "sysupgrade failed"
+	# Should we reboot or bring up some failsafe mode instead?
+	umount -a
+	reboot -f
+}
+
+# Check if passed file is a valid one for NAND sysupgrade.
+# Currently it accepts 4 types of files:
+# 1) UBI: a ubinized image containing required UBI volumes.
+# 2) UBIFS: a UBIFS rootfs volume image.
+# 3) FIT: a FIT image containing kernel and rootfs.
+# 4) TAR: an archive that includes directory "sysupgrade-${BOARD_NAME}" containing
+#         a non-empty "CONTROL" file and required partition and/or volume images.
 #
 # You usually want to call this function in platform_check_image.
 #
@@ -367,14 +453,21 @@ nand_do_upgrade() {
 # $(2): file to be checked
 nand_do_platform_check() {
 	local board_name="$1"
-	local tar_file="$2"
-	local control_length=$( (tar xf $tar_file sysupgrade-$board_name/CONTROL -O | wc -c) 2> /dev/null)
-	local file_type="$(identify $2)"
+	local file="$2"
 
-	[ "$control_length" = 0 -a "$file_type" != "ubi" -a "$file_type" != "ubifs" -a "$file_type" != "fit" ] && {
-		echo "Invalid sysupgrade file."
-		return 1
-	}
+	local gz="$(identify_if_gzip "$file")"
+	local file_type="$(identify "$file" "" "$gz")"
+	local control_length=$( (tar xO${gz}f "$file" "sysupgrade-$board_name/CONTROL" | wc -c) 2> /dev/null)
+
+	if [ "$control_length" != 0 ]; then
+		nand_verify_tar_file "$file" "$gz" || return 1
+	else
+		nand_verify_if_gzip_file "$file" "$gz" || return 1
+		if [ "$file_type" != "fit" -a "$file_type" != "ubi" -a "$file_type" != "ubifs" ]; then
+			echo "invalid sysupgrade file"
+			return 1
+		fi
+	fi
 
 	return 0
 }
diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
index 5e0d73631b..6314d40646 100755
--- a/package/base-files/files/lib/upgrade/stage2
+++ b/package/base-files/files/lib/upgrade/stage2
@@ -39,9 +39,9 @@ switch_to_ramfs() {
 	for binary in \
 		/bin/busybox /bin/ash /bin/sh /bin/mount /bin/umount	\
 		pivot_root mount_root reboot sync kill sleep		\
-		md5sum hexdump cat zcat dd tar				\
+		md5sum hexdump cat zcat dd tar gzip			\
 		ls basename find cp mv rm mkdir rmdir mknod touch chmod \
-		'[' printf wc grep awk sed cut				\
+		'[' printf wc grep awk sed cut sort			\
 		mtd partx losetup mkfs.ext4 nandwrite flash_erase	\
 		ubiupdatevol ubiattach ubiblock ubiformat		\
 		ubidetach ubirsvol ubirmvol ubimkvol			\
diff --git a/package/base-files/files/sbin/wifi b/package/base-files/files/sbin/wifi
index 6b9662fe93..6a9dce7e8a 100755
--- a/package/base-files/files/sbin/wifi
+++ b/package/base-files/files/sbin/wifi
@@ -128,14 +128,14 @@ wifi_updown() {
 	[ enable = "$1" ] && {
 		_wifi_updown disable "$2"
 		ubus_wifi_cmd "$cmd" "$2"
+		ubus call network reload
 		scan_wifi
 		cmd=up
-		ubus call network reload
 	}
 	[ reconf = "$1" ] && {
+		ubus call network reload
 		scan_wifi
 		cmd=reconf
-		ubus call network reload
 	}
 	ubus_wifi_cmd "$cmd" "$2"
 	_wifi_updown "$@"
diff --git a/package/boot/uboot-envtools/files/ath79 b/package/boot/uboot-envtools/files/ath79
index d9e504bf89..f255040f7d 100644
--- a/package/boot/uboot-envtools/files/ath79
+++ b/package/boot/uboot-envtools/files/ath79
@@ -83,7 +83,8 @@ buffalo,wzr-hp-ag300h)
 	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000" "0x10000"
 	;;
 buffalo,wzr-hp-g300nh-rb|\
-buffalo,wzr-hp-g300nh-s)
+buffalo,wzr-hp-g300nh-s|\
+linksys,ea4500-v3)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	;;
 domywifi,dw33d)
diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index a29ec7d0ee..fe986b2e4e 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -34,9 +34,13 @@ bananapi,bpi-r3)
 		;;
 	esac
 	;;
+xiaomi,redmi-router-ax6000)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
+	ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x10000" "0x20000"
+	;;
 esac
 
 config_load ubootenv
-config_foreach ubootenv_add_app_config ubootenv
+config_foreach ubootenv_add_app_config
 
 exit 0
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index f15a08d62e..46f5dea7ae 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -242,23 +242,56 @@ endef
 $(eval $(call KernelPackage,gpio-f7188x))
 
 
-define KernelPackage/gpio-mcp23s08
+define KernelPackage/pinctrl-mcp23s08
   SUBMENU:=$(OTHER_MENU)
   TITLE:=Microchip MCP23xxx I/O expander
-  DEPENDS:=@GPIO_SUPPORT +kmod-i2c-core +kmod-regmap-i2c
-  KCONFIG:= \
-	CONFIG_GPIO_MCP23S08 \
-	CONFIG_PINCTRL_MCP23S08
-  FILES:= \
-	$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
+  HIDDEN:=1
+  DEPENDS:=@GPIO_SUPPORT +kmod-regmap-core
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08.ko
   AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08)
 endef
 
-define KernelPackage/gpio-mcp23s08/description
- Kernel module for Microchip MCP23xxx SPI/I2C I/O expander
+define KernelPackage/pinctrl-mcp23s08/description
+  Kernel module for Microchip MCP23xxx I/O expander
 endef
 
-$(eval $(call KernelPackage,gpio-mcp23s08))
+$(eval $(call KernelPackage,pinctrl-mcp23s08))
+
+
+define KernelPackage/pinctrl-mcp23s08-i2c
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (I2C)
+  DEPENDS:=@GPIO_SUPPORT \
+	+kmod-pinctrl-mcp23s08 \
+	+kmod-i2c-core \
+	+kmod-regmap-i2c
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_I2C
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_i2c.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-i2c)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-i2c/description
+  Kernel module for Microchip MCP23xxx I/O expander via I2C
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08-i2c))
+
+
+define KernelPackage/pinctrl-mcp23s08-spi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Microchip MCP23xxx I/O expander (SPI)
+  DEPENDS:=@GPIO_SUPPORT +kmod-pinctrl-mcp23s08
+  KCONFIG:=CONFIG_PINCTRL_MCP23S08_SPI
+  FILES:=$(LINUX_DIR)/drivers/pinctrl/pinctrl-mcp23s08_spi.ko
+  AUTOLOAD:=$(call AutoLoad,40,pinctrl-mcp23s08-spi)
+endef
+
+define KernelPackage/pinctrl-mcp23s08-spi/description
+  Kernel module for Microchip MCP23xxx I/O expander via SPI
+endef
+
+$(eval $(call KernelPackage,pinctrl-mcp23s08-spi))
 
 
 define KernelPackage/gpio-nxp-74hc164
diff --git a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
index 61ac7708ba..bf8a8b9c2c 100644
--- a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
+++ b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
@@ -137,6 +137,10 @@ static DSL_CPE_ThreadCtrl_t thread;
 static struct ubus_context *ctx;
 static struct blob_buf b;
 
+static inline void m_null() {
+	blobmsg_add_field(&b, BLOBMSG_TYPE_UNSPEC, "", NULL, 0);
+}
+
 static inline void m_double(const char *id, double value) {
 	blobmsg_add_double(&b, id, value);
 }
@@ -153,14 +157,15 @@ static inline void m_str(const char *id, const char *value) {
 	blobmsg_add_string(&b, id, value);
 }
 
-static inline void m_db(const char *id, int value) {
-	m_double(id, (double)value / 10);
+static inline void m_db(const char *id, int value, int invalid) {
+	if (value != invalid)
+		m_double(id, (double)value / 10);
 }
 
-static inline void m_array(const char *id, const uint8_t *value, uint8_t len) {
+static inline void m_array(const char *id, const uint8_t *value, size_t len) {
 	void *c = blobmsg_open_array(&b, id);
 
-	for (uint8_t i = 0; i < len; ++i)
+	for (size_t i = 0; i < len; ++i)
 		blobmsg_add_u16(&b, "", value[i]);
 
 	blobmsg_close_array(&b, c);
@@ -413,6 +418,69 @@ static void g997_line_inventory(int fd) {
 	m_array("serial", out.data.SerialNumber, DSL_G997_LI_MAXLEN_SERIAL);
 }
 
+static void g977_get_bit_allocation(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR(DSL_G997_BitAllocationNsc_t, DSL_FIO_G997_BIT_ALLOCATION_NSC_GET, direction);
+
+	// create default value to obtain consistent JSON structure
+	m_u32("groupsize", 1);
+	m_u32("groups", out.data.bitAllocationNsc.nNumData);
+	m_array("data", out.data.bitAllocationNsc.nNSCData, out.data.bitAllocationNsc.nNumData);
+}
+
+static void g977_get_snr(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltSnr_t, DSL_FIO_G997_DELT_SNR_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltSnr.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// SNR -32 ... 95 dB
+	for (uint16_t i  = 0  ; i < out.data.deltSnr.nNumData ; i++)
+		if (out.data.deltSnr.nNSCData[i] != 255 && out.data.deltSnr.nNSCData[i] != 0)
+			m_double("", -32 + (double)out.data.deltSnr.nNSCData[i] / 2);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g977_get_qln(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltQln_t, DSL_FIO_G997_DELT_QLN_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltQln.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// QLN -150 ... -23 dBm/Hz
+	for (uint16_t i  = 0  ; i < out.data.deltQln.nNumData ; i++)
+		if (out.data.deltQln.nNSCData[i] != 255 && out.data.deltQln.nNSCData[i] != 0)
+			m_double("", -23 - (double)out.data.deltQln.nNSCData[i] / 2);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
+static void g977_get_hlog(int fd, DSL_AccessDir_t direction) {
+	IOCTL_DIR_DELT(DSL_G997_DeltHlog_t, DSL_FIO_G997_DELT_HLOG_GET, direction, DSL_DELT_DATA_SHOWTIME);
+
+	m_u32("groupsize", out.data.nGroupSize);
+	m_u32("groups", out.data.deltHlog.nNumData);
+
+	void *c = blobmsg_open_array(&b, "data");
+
+	// HLOG +6 ... -96 dB
+	for (uint16_t i  = 0  ; i < out.data.deltHlog.nNumData ; i++)
+		if (out.data.deltHlog.nNSCData[i] != 1023 && out.data.deltHlog.nNSCData[i] != 0)
+			m_double("", 6 - (double)out.data.deltHlog.nNSCData[i] / 10);
+		else
+			m_null();
+
+	blobmsg_close_array(&b, c);
+}
+
 static void g997_power_management_status(int fd) {
 	IOCTL(DSL_G997_PowerManagementStatus_t, DSL_FIO_G997_POWER_MANAGEMENT_STATUS_GET)
 
@@ -595,11 +663,12 @@ static void g997_channel_status(int fd, DSL_AccessDir_t direction) {
 static void g997_line_status(int fd, DSL_AccessDir_t direction) {
 	IOCTL_DIR_DELT(DSL_G997_LineStatus_t, DSL_FIO_G997_LINE_STATUS_GET, direction, DSL_DELT_DATA_SHOWTIME);
 
-	m_db("latn", out.data.LATN);
-	m_db("satn", out.data.SATN);
-	m_db("snr", out.data.SNR);
-	m_db("actps", out.data.ACTPS);
-	m_db("actatp", out.data.ACTATP);
+	// invalid value indicators taken from drv_dsl_cpe_api_g997.h
+	m_db("latn", out.data.LATN, 1271);
+	m_db("satn", out.data.SATN, 1271);
+	m_db("snr", out.data.SNR, -641);
+	m_db("actps", out.data.ACTPS, -901);
+	m_db("actatp", out.data.ACTATP, -512);
 	m_u32("attndr", out.data.ATTNDR);
 }
 
@@ -724,6 +793,66 @@ static void describe_mode(standard_t standard, profile_t profile, vector_t vecto
 	m_str("mode", buf);
 }
 
+static int line_statistics(struct ubus_context *ctx, struct ubus_object *obj,
+                   struct ubus_request_data *req, const char *method,
+                   struct blob_attr *msg)
+{
+	int fd;
+	void *c, *c2;
+
+#ifndef INCLUDE_DSL_CPE_API_DANUBE
+	fd = open(DSL_CPE_DEVICE_NAME "/0", O_RDWR, 0644);
+#else
+	fd = open(DSL_CPE_DEVICE_NAME, O_RDWR, 0644);
+#endif
+	if (fd < 0)
+		return UBUS_STATUS_UNKNOWN_ERROR;
+
+	blob_buf_init(&b, 0);
+
+	c = blobmsg_open_table(&b, "bits");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_bit_allocation(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_bit_allocation(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "snr");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_snr(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_snr(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "qln");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_qln(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_qln(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	c = blobmsg_open_table(&b, "hlog");
+	c2 = blobmsg_open_table(&b, "downstream");
+	g977_get_hlog(fd, DSL_DOWNSTREAM);
+	blobmsg_close_table(&b, c2);
+	c2 = blobmsg_open_table(&b, "upstream");
+	g977_get_hlog(fd, DSL_UPSTREAM);
+	blobmsg_close_table(&b, c2);
+	blobmsg_close_table(&b, c);
+
+	ubus_send_reply(ctx, req, b.head);
+
+	close(fd);
+
+	return 0;
+}
+
 static int metrics(struct ubus_context *ctx, struct ubus_object *obj,
 		   struct ubus_request_data *req, const char *method,
 		   struct blob_attr *msg)
@@ -837,6 +966,7 @@ static int metrics(struct ubus_context *ctx, struct ubus_object *obj,
 
 static const struct ubus_method dsl_methods[] = {
 	UBUS_METHOD_NOARG("metrics", metrics),
+	UBUS_METHOD_NOARG("statistics", line_statistics)
 };
 
 static struct ubus_object_type dsl_object_type =
diff --git a/scripts/linksys-image.sh b/scripts/linksys-image.sh
index c3baf44844..3b4412c06e 100755
--- a/scripts/linksys-image.sh
+++ b/scripts/linksys-image.sh
@@ -14,7 +14,7 @@
 #  <VERSION>        The version number of upgrade. Not checked so use arbitrary value (8 bytes)
 #  <TYPE>           Model of target device, padded (0x20) to (15 bytes)
 #  <CRC>      	    CRC checksum of the image to flash (8 byte)
-#  <padding>	    Padding (0x20) (7 bytes)
+#  <padding>	    Padding ('0' + 0x20 *7) (8 bytes)
 #  <signature>	    Signature of signer. Not checked so use arbitrary value (16 bytes)
 #  <padding>        Padding (0x00) (192 bytes)
 #  0x0A		    (1 byte)
@@ -58,7 +58,7 @@ IMG_OUT="${IMG_IN}.new"
 dd if="${IMG_IN}" of="${IMG_TMP_OUT}"
 CRC=$(printf "%08X" $(dd if="${IMG_IN}" bs=$(stat -c%s "${IMG_IN}") count=1|cksum| cut -d ' ' -f1))
 
-printf ".LINKSYS.01000409%-15s%-8s%-7s%-16s" "${TYPE}" "${CRC}" "" "K0000000F0246434" >> "${IMG_TMP_OUT}"
+printf ".LINKSYS.01000409%-15s%-8s%-8s%-16s" "${TYPE}" "${CRC}" "0" "K0000000F0246434" >> "${IMG_TMP_OUT}"
 
 dd if=/dev/zero bs=1 count=192 conv=notrunc >> "${IMG_TMP_OUT}"
 
diff --git a/target/linux/apm821xx/patches-5.10/802-usb-xhci-force-msi-renesas-xhci.patch b/target/linux/apm821xx/patches-5.10/802-usb-xhci-force-msi-renesas-xhci.patch
index c995c90402..288276cca6 100644
--- a/target/linux/apm821xx/patches-5.10/802-usb-xhci-force-msi-renesas-xhci.patch
+++ b/target/linux/apm821xx/patches-5.10/802-usb-xhci-force-msi-renesas-xhci.patch
@@ -43,7 +43,7 @@ produce a noisy warning.
  		hcd->msi_enabled = 1;
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1895,6 +1895,7 @@ struct xhci_hcd {
+@@ -1896,6 +1896,7 @@ struct xhci_hcd {
  	struct xhci_hub		usb2_rhub;
  	struct xhci_hub		usb3_rhub;
  	/* support xHCI 1.0 spec USB2 hardware LPM */
diff --git a/target/linux/apm821xx/patches-5.10/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch b/target/linux/apm821xx/patches-5.10/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
index fb532b2cc0..3d7cc39a63 100644
--- a/target/linux/apm821xx/patches-5.10/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
+++ b/target/linux/apm821xx/patches-5.10/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
@@ -18,7 +18,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -250,7 +250,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
+@@ -251,7 +251,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
  
  # args (to if_changed): 1 = (this rule), 2 = platform, 3 = dts 4=dtb 5=initrd
  quiet_cmd_wrap	= WRAP    $@
diff --git a/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch b/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
index 3a9f48d0ab..1ba8a45cb6 100644
--- a/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
+++ b/target/linux/apm821xx/patches-5.15/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
@@ -18,7 +18,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -257,7 +257,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
+@@ -258,7 +258,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
  
  # args (to if_changed): 1 = (this rule), 2 = platform, 3 = dts 4=dtb 5=initrd
  quiet_cmd_wrap	= WRAP    $@
diff --git a/target/linux/at91/image/sam9x.mk b/target/linux/at91/image/sam9x.mk
index b6c5e33ac4..4de9609775 100644
--- a/target/linux/at91/image/sam9x.mk
+++ b/target/linux/at91/image/sam9x.mk
@@ -126,7 +126,8 @@ define Device/calamp_lmu5000
   DEVICE_VENDOR := CalAmp
   DEVICE_MODEL := LMU5000
   DEVICE_PACKAGES := kmod-rtc-pcf2123 kmod-usb-acm \
-	kmod-usb-serial-option kmod-usb-serial-sierrawireless kmod-gpio-mcp23s08
+	kmod-usb-serial-option kmod-usb-serial-sierrawireless \
+	kmod-pinctrl-mcp23s08-spi
 endef
 TARGET_DEVICES += calamp_lmu5000
 
diff --git a/target/linux/at91/sam9x/config-5.10 b/target/linux/at91/sam9x/config-5.10
index 63575c6093..021231d3df 100644
--- a/target/linux/at91/sam9x/config-5.10
+++ b/target/linux/at91/sam9x/config-5.10
@@ -217,9 +217,6 @@ CONFIG_PHYLINK=y
 CONFIG_PINCTRL=y
 CONFIG_PINCTRL_AT91=y
 # CONFIG_PINCTRL_AT91PIO4 is not set
-CONFIG_PINCTRL_MCP23S08=y
-CONFIG_PINCTRL_MCP23S08_I2C=y
-CONFIG_PINCTRL_MCP23S08_SPI=y
 CONFIG_PM=y
 CONFIG_PM_CLK=y
 CONFIG_PM_SLEEP=y
diff --git a/target/linux/at91/sam9x/config-5.15 b/target/linux/at91/sam9x/config-5.15
index ffbd2aba62..3aa652c188 100644
--- a/target/linux/at91/sam9x/config-5.15
+++ b/target/linux/at91/sam9x/config-5.15
@@ -219,9 +219,6 @@ CONFIG_PHYLINK=y
 CONFIG_PINCTRL=y
 CONFIG_PINCTRL_AT91=y
 # CONFIG_PINCTRL_AT91PIO4 is not set
-CONFIG_PINCTRL_MCP23S08=y
-CONFIG_PINCTRL_MCP23S08_I2C=y
-CONFIG_PINCTRL_MCP23S08_SPI=y
 CONFIG_PM=y
 CONFIG_PM_CLK=y
 CONFIG_PM_SLEEP=y
diff --git a/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
new file mode 100644
index 0000000000..000dbce8e1
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "linksys,ea4500-v3", "qca,qca9558";
+	model = "Linksys EA4500 v3";
+
+	aliases {
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+		label-mac-device = &eth1;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_system: system {
+			label = "green:system";
+			gpios = <&gpio 21 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&cal_ath9k_pci>;
+		nvmem-cell-names = "calibration";
+	};
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "uboot";
+			reg = <0x0 0x100000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "u_env";
+			reg = <0x100000 0x40000>;
+		};
+
+		partition@140000 {
+			label = "caldata";
+			reg = <0x140000 0x40000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			cal_macaddr: macaddr@0 {
+				reg = <0x6 0x6>;
+			};
+
+			cal_ath9k_soc: cal_ath9k@1000 {
+				reg = <0x1000 0x440>;
+			};
+
+			cal_ath9k_pci: cal_ath9k@5000 {
+				reg = <0x5000 0x440>;
+			};
+		};
+
+		partition@180000 {
+			label = "s_env";
+			reg = <0x180000 0x40000>;
+			read-only;
+		};
+
+		partition@1c0000 {
+			label = "devinfo";
+			reg = <0x1c0000 0x100000>;
+			read-only;
+		};
+
+		partition@2c0000 {
+			label = "firmware";
+			reg = <0x2c0000 0x5000000>;
+
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x400000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x400000 0x4c00000>;
+			};
+
+			/* Original layout for secondary partitions */
+			/* partition@2800000 {
+				label = "kernel2";
+				reg = <0x2800000 0x400000>;
+			};
+
+			partition@2c00000 {
+				label = "ubi2";
+				reg = <0x2c00000 0x2400000>;
+			}; */
+		};
+
+		partition@52c0000 {
+			label = "syscfg";
+			reg = <0x52c0000 0x2d40000>;
+			read-only;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+
+		qca,ar8327-initvals = <
+			0x04 0x07600000 /* PORT0 PAD MODE CTRL: RGMII, to eth0 */
+			0x0c 0x00000080 /* PORT6 PAD MODE CTRL: SGMII, to eth1 */
+			0x50 0xc833c833 /* LED_CTRL0: orange, blinking with act */
+			0x54 0xcf85cf85 /* LED_CTRL1: green, on with link */
+			0x58 0x00000000	/* LED_CTRL2: unpopulated */
+			0x5c 0x00f3cf00 /* LED_CTRL3: enable led 0 and 1 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6 STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&cal_macaddr>;
+	nvmem-cell-names = "mac-address";
+	phy-handle = <&phy0>;
+	pll-data = <0x96000000 0x00000101 0x00001616>;
+
+	gmac-config {
+		device = <&gmac>;
+		rgmii-enabled = <1>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	nvmem-cells = <&cal_macaddr>;
+	nvmem-cell-names = "mac-address";
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_ath9k_soc>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/image/nand.mk b/target/linux/ath79/image/nand.mk
index 117f6e99cd..9da47ad38e 100644
--- a/target/linux/ath79/image/nand.mk
+++ b/target/linux/ath79/image/nand.mk
@@ -211,6 +211,25 @@ define Device/glinet_gl-xe300
 endef
 TARGET_DEVICES += glinet_gl-xe300
 
+define Device/linksys_ea4500-v3
+  SOC := qca9558
+  DEVICE_VENDOR := Linksys
+  DEVICE_MODEL := EA4500
+  DEVICE_VARIANT := v3
+  DEVICE_PACKAGES := kmod-usb2
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 4096k
+  IMAGE_SIZE := 81920k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  LINKSYS_HWNAME := EA4500V3
+  IMAGES += factory.img
+  IMAGE/factory.img := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+	append-ubi | check-size | linksys-image type=$$$$(LINKSYS_HWNAME)
+  UBINIZE_OPTS := -E 5
+endef
+TARGET_DEVICES += linksys_ea4500-v3
+
 # fake rootfs is mandatory, pad-offset 129 equals (2 * uimage_header + 0xff)
 define Device/netgear_ath79_nand
   DEVICE_VENDOR := NETGEAR
diff --git a/target/linux/ath79/nand/base-files/etc/board.d/02_network b/target/linux/ath79/nand/base-files/etc/board.d/02_network
index b252d7d9e8..b163b29db1 100644
--- a/target/linux/ath79/nand/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/nand/base-files/etc/board.d/02_network
@@ -30,6 +30,10 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "4:lan"
 		;;
+	linksys,ea4500-v3)
+		ucidef_add_switch "switch0" \
+			"6@eth1" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "0@eth0"
+		;;
 	netgear,pgzng1)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		;;
diff --git a/target/linux/ath79/nand/base-files/etc/init.d/bootcount b/target/linux/ath79/nand/base-files/etc/init.d/bootcount
index 87654ba095..4d7a814f05 100755
--- a/target/linux/ath79/nand/base-files/etc/init.d/bootcount
+++ b/target/linux/ath79/nand/base-files/etc/init.d/bootcount
@@ -8,5 +8,9 @@ boot() {
 	glinet,gl-ar300m-nand)
 		fw_setenv bootcount 0
 		;;
+	linksys,ea4500-v3)
+		[ $(fw_printenv -n auto_recovery) = yes ] && \
+			fw_setenv auto_recovery no
+		;;
 	esac
 }
diff --git a/target/linux/ath79/patches-5.10/401-mtd-nor-support-mtd-name-from-device-tree.patch b/target/linux/ath79/patches-5.10/401-mtd-nor-support-mtd-name-from-device-tree.patch
index 62f610492f..5b14d1f8cb 100644
--- a/target/linux/ath79/patches-5.10/401-mtd-nor-support-mtd-name-from-device-tree.patch
+++ b/target/linux/ath79/patches-5.10/401-mtd-nor-support-mtd-name-from-device-tree.patch
@@ -34,7 +34,7 @@ Signed-off-by: Abhimanyu Vishwakarma <Abhimanyu.Vishwakarma@imgtec.com>
  	mtd->type = MTD_NORFLASH;
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -851,6 +851,17 @@ out_error:
+@@ -843,6 +843,17 @@ out_error:
   */
  static void mtd_set_dev_defaults(struct mtd_info *mtd)
  {
diff --git a/target/linux/ath79/patches-5.10/404-mtd-cybertan-trx-parser.patch b/target/linux/ath79/patches-5.10/404-mtd-cybertan-trx-parser.patch
index cfc017871f..4e8e536e29 100644
--- a/target/linux/ath79/patches-5.10/404-mtd-cybertan-trx-parser.patch
+++ b/target/linux/ath79/patches-5.10/404-mtd-cybertan-trx-parser.patch
@@ -25,7 +25,7 @@ Submitted-by: Christian Lamparter <chunkeey@gmail.com>
 +obj-$(CONFIG_MTD_PARSER_CYBERTAN)	+= parser_cybertan.o
  obj-$(CONFIG_MTD_PARSER_IMAGETAG)	+= parser_imagetag.o
  obj-$(CONFIG_MTD_AFS_PARTS)		+= afs.o
- obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_trx.o
+ obj-$(CONFIG_MTD_PARSER_TPLINK_SAFELOADER)	+= tplink_safeloader.o
 --- a/drivers/mtd/parsers/Kconfig
 +++ b/drivers/mtd/parsers/Kconfig
 @@ -102,6 +102,14 @@ config MTD_OF_PARTS_LINKSYS_NS
diff --git a/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch b/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
index f5d3a5ed58..84ee47a115 100644
--- a/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
+++ b/target/linux/ath79/patches-5.15/910-unaligned_access_hacks.patch
@@ -215,7 +215,7 @@ SVN-Revision: 35130
  #define UDP_CORK	1	/* Never send partially complete segments */
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -305,8 +305,8 @@ nf_ct_get_tuple(const struct sk_buff *sk
+@@ -308,8 +308,8 @@ nf_ct_get_tuple(const struct sk_buff *sk
  
  	switch (l3num) {
  	case NFPROTO_IPV4:
@@ -737,7 +737,7 @@ SVN-Revision: 35130
  				       | TCPOLEN_TIMESTAMP))
 --- a/net/xfrm/xfrm_input.c
 +++ b/net/xfrm/xfrm_input.c
-@@ -165,8 +165,8 @@ int xfrm_parse_spi(struct sk_buff *skb,
+@@ -166,8 +166,8 @@ int xfrm_parse_spi(struct sk_buff *skb,
  	if (!pskb_may_pull(skb, hlen))
  		return -EINVAL;
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0046-Register-the-clocks-early-during-the-boot-process-so.patch b/target/linux/bcm27xx/patches-5.15/950-0046-Register-the-clocks-early-during-the-boot-process-so.patch
index 8dd6abdfdb..195e25e059 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0046-Register-the-clocks-early-during-the-boot-process-so.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0046-Register-the-clocks-early-during-the-boot-process-so.patch
@@ -13,7 +13,7 @@ Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2289,8 +2289,15 @@ static int bcm2835_clk_probe(struct plat
+@@ -2320,8 +2320,15 @@ static int bcm2835_clk_probe(struct plat
  	if (ret)
  		return ret;
  
@@ -30,7 +30,7 @@ Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
  }
  
  static const struct cprman_plat_data cprman_bcm2835_plat_data = {
-@@ -2316,7 +2323,11 @@ static struct platform_driver bcm2835_cl
+@@ -2347,7 +2354,11 @@ static struct platform_driver bcm2835_cl
  	.probe          = bcm2835_clk_probe,
  };
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0048-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch b/target/linux/bcm27xx/patches-5.15/950-0048-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
index 8f004a80d9..561f827a53 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0048-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0048-clk-bcm2835-Mark-used-PLLs-and-dividers-CRITICAL.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1378,6 +1378,11 @@ bcm2835_register_pll_divider(struct bcm2
+@@ -1408,6 +1408,11 @@ bcm2835_register_pll_divider(struct bcm2
  	divider->div.hw.init = &init;
  	divider->div.table = NULL;
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0049-clk-bcm2835-Add-claim-clocks-property.patch b/target/linux/bcm27xx/patches-5.15/950-0049-clk-bcm2835-Add-claim-clocks-property.patch
index 809b571c52..f2b8c85d4c 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0049-clk-bcm2835-Add-claim-clocks-property.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0049-clk-bcm2835-Add-claim-clocks-property.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1306,6 +1306,8 @@ static const struct clk_ops bcm2835_vpu_
+@@ -1336,6 +1336,8 @@ static const struct clk_ops bcm2835_vpu_
  	.debug_init = bcm2835_clock_debug_init,
  };
  
@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
  					   const void *data)
  {
-@@ -1323,6 +1325,9 @@ static struct clk_hw *bcm2835_register_p
+@@ -1353,6 +1355,9 @@ static struct clk_hw *bcm2835_register_p
  	init.ops = &bcm2835_pll_clk_ops;
  	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
  
@@ -36,7 +36,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
  	if (!pll)
  		return NULL;
-@@ -1378,9 +1383,11 @@ bcm2835_register_pll_divider(struct bcm2
+@@ -1408,9 +1413,11 @@ bcm2835_register_pll_divider(struct bcm2
  	divider->div.hw.init = &init;
  	divider->div.table = NULL;
  
@@ -51,7 +51,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	}
  
  	divider->cprman = cprman;
-@@ -1437,6 +1444,15 @@ static struct clk_hw *bcm2835_register_c
+@@ -1467,6 +1474,15 @@ static struct clk_hw *bcm2835_register_c
  	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
  
  	/*
@@ -67,7 +67,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	 * Pass the CLK_SET_RATE_PARENT flag if we are allowed to propagate
  	 * rate changes on at least of the parents.
  	 */
-@@ -2215,6 +2231,8 @@ static const struct bcm2835_clk_desc clk
+@@ -2246,6 +2262,8 @@ static const struct bcm2835_clk_desc clk
  		.ctl_reg = CM_PERIICTL),
  };
  
@@ -76,7 +76,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  /*
   * Permanently take a reference on the parent of the SDRAM clock.
   *
-@@ -2234,6 +2252,19 @@ static int bcm2835_mark_sdc_parent_criti
+@@ -2265,6 +2283,19 @@ static int bcm2835_mark_sdc_parent_criti
  	return clk_prepare_enable(parent);
  }
  
@@ -96,7 +96,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static int bcm2835_clk_probe(struct platform_device *pdev)
  {
  	struct device *dev = &pdev->dev;
-@@ -2243,6 +2274,7 @@ static int bcm2835_clk_probe(struct plat
+@@ -2274,6 +2305,7 @@ static int bcm2835_clk_probe(struct plat
  	const size_t asize = ARRAY_SIZE(clk_desc_array);
  	const struct cprman_plat_data *pdata;
  	size_t i;
@@ -104,7 +104,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	int ret;
  
  	pdata = of_device_get_match_data(&pdev->dev);
-@@ -2261,6 +2293,13 @@ static int bcm2835_clk_probe(struct plat
+@@ -2292,6 +2324,13 @@ static int bcm2835_clk_probe(struct plat
  	if (IS_ERR(cprman->regs))
  		return PTR_ERR(cprman->regs);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0050-clk-bcm2835-Read-max-core-clock-from-firmware.patch b/target/linux/bcm27xx/patches-5.15/950-0050-clk-bcm2835-Read-max-core-clock-from-firmware.patch
index cfa152c2f6..6d67d29ac8 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0050-clk-bcm2835-Read-max-core-clock-from-firmware.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0050-clk-bcm2835-Read-max-core-clock-from-firmware.patch
@@ -25,7 +25,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -35,6 +35,7 @@
+@@ -36,6 +36,7 @@
  #include <linux/platform_device.h>
  #include <linux/slab.h>
  #include <dt-bindings/clock/bcm2835.h>
@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  #define CM_PASSWORD		0x5a000000
  
-@@ -295,6 +296,8 @@
+@@ -296,6 +297,8 @@
  #define SOC_BCM2711		BIT(1)
  #define SOC_ALL			(SOC_BCM2835 | SOC_BCM2711)
  
@@ -42,7 +42,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  /*
   * Names of clocks used within the driver that need to be replaced
   * with an external parent's name.  This array is in the order that
-@@ -313,6 +316,7 @@ static const char *const cprman_parent_n
+@@ -314,6 +317,7 @@ static const char *const cprman_parent_n
  struct bcm2835_cprman {
  	struct device *dev;
  	void __iomem *regs;
@@ -50,8 +50,8 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	spinlock_t regs_lock; /* spinlock for all clocks */
  	unsigned int soc;
  
-@@ -1010,6 +1014,30 @@ static unsigned long bcm2835_clock_get_r
- 	return bcm2835_clock_rate_from_divisor(clock, parent_rate, div);
+@@ -1040,6 +1044,30 @@ static unsigned long bcm2835_clock_get_r
+ 	return rate;
  }
  
 +static unsigned long bcm2835_clock_get_rate_vpu(struct clk_hw *hw,
@@ -81,7 +81,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock)
  {
  	struct bcm2835_cprman *cprman = clock->cprman;
-@@ -1298,7 +1326,7 @@ static int bcm2835_vpu_clock_is_on(struc
+@@ -1328,7 +1356,7 @@ static int bcm2835_vpu_clock_is_on(struc
   */
  static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
  	.is_prepared = bcm2835_vpu_clock_is_on,
@@ -90,7 +90,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	.set_rate = bcm2835_clock_set_rate,
  	.determine_rate = bcm2835_clock_determine_rate,
  	.set_parent = bcm2835_clock_set_parent,
-@@ -2273,6 +2301,7 @@ static int bcm2835_clk_probe(struct plat
+@@ -2304,6 +2332,7 @@ static int bcm2835_clk_probe(struct plat
  	const struct bcm2835_clk_desc *desc;
  	const size_t asize = ARRAY_SIZE(clk_desc_array);
  	const struct cprman_plat_data *pdata;
@@ -98,7 +98,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	size_t i;
  	u32 clk_id;
  	int ret;
-@@ -2293,6 +2322,14 @@ static int bcm2835_clk_probe(struct plat
+@@ -2324,6 +2353,14 @@ static int bcm2835_clk_probe(struct plat
  	if (IS_ERR(cprman->regs))
  		return PTR_ERR(cprman->regs);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0070-MMC-added-alternative-MMC-driver.patch b/target/linux/bcm27xx/patches-5.15/950-0070-MMC-added-alternative-MMC-driver.patch
index 42c8cef645..754b633967 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0070-MMC-added-alternative-MMC-driver.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0070-MMC-added-alternative-MMC-driver.patch
@@ -244,7 +244,7 @@ bcm2835-mmc: uninitialized_var is no more
  static inline int mmc_blk_part_switch(struct mmc_card *card,
  				      unsigned int part_type);
  static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
-@@ -2923,6 +2930,8 @@ static int mmc_blk_probe(struct mmc_card
+@@ -2928,6 +2935,8 @@ static int mmc_blk_probe(struct mmc_card
  {
  	struct mmc_blk_data *md;
  	int ret = 0;
@@ -253,7 +253,7 @@ bcm2835-mmc: uninitialized_var is no more
  
  	/*
  	 * Check that the card supports the command class(es) we need.
-@@ -2930,7 +2939,16 @@ static int mmc_blk_probe(struct mmc_card
+@@ -2935,7 +2944,16 @@ static int mmc_blk_probe(struct mmc_card
  	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
  		return -ENODEV;
  
@@ -271,7 +271,7 @@ bcm2835-mmc: uninitialized_var is no more
  
  	card->complete_wq = alloc_workqueue("mmc_complete",
  					WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
-@@ -2945,6 +2963,17 @@ static int mmc_blk_probe(struct mmc_card
+@@ -2950,6 +2968,17 @@ static int mmc_blk_probe(struct mmc_card
  		goto out_free;
  	}
  
@@ -303,9 +303,9 @@ bcm2835-mmc: uninitialized_var is no more
  }
 --- a/drivers/mmc/core/quirks.h
 +++ b/drivers/mmc/core/quirks.h
-@@ -99,6 +99,14 @@ static const struct mmc_fixup __maybe_un
- 	MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc,
- 		  MMC_QUIRK_TRIM_BROKEN),
+@@ -105,6 +105,14 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
+ 		  MMC_QUIRK_BROKEN_SD_DISCARD),
  
 +	/*
 +	 *  On some Kingston SD cards, multiple erases of less than 64
@@ -2004,9 +2004,9 @@ bcm2835-mmc: uninitialized_var is no more
  
 --- a/include/linux/mmc/card.h
 +++ b/include/linux/mmc/card.h
-@@ -293,6 +293,8 @@ struct mmc_card {
- #define MMC_QUIRK_TRIM_BROKEN	(1<<12)		/* Skip trim */
+@@ -294,6 +294,8 @@ struct mmc_card {
  #define MMC_QUIRK_BROKEN_HPI	(1<<13)		/* Disable broken HPI support */
+ #define MMC_QUIRK_BROKEN_SD_DISCARD	(1<<14)	/* Disable broken SD discard support */
  
 +#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
 +
diff --git a/target/linux/bcm27xx/patches-5.15/950-0134-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch b/target/linux/bcm27xx/patches-5.15/950-0134-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch
index a7c0f52876..b005799e74 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0134-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0134-clk-clk-bcm2835-Use-zd-when-printing-size_t.patch
@@ -13,7 +13,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2376,7 +2376,7 @@ static int bcm2835_clk_probe(struct plat
+@@ -2407,7 +2407,7 @@ static int bcm2835_clk_probe(struct plat
  		return ret;
  
  	/* note that we have registered all the clocks */
diff --git a/target/linux/bcm27xx/patches-5.15/950-0147-clk-bcm2835-Don-t-wait-for-pllh-lock.patch b/target/linux/bcm27xx/patches-5.15/950-0147-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
index 7ee8aa7cbb..2db6f60525 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0147-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0147-clk-bcm2835-Don-t-wait-for-pllh-lock.patch
@@ -10,7 +10,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -644,15 +644,17 @@ static int bcm2835_pll_on(struct clk_hw
+@@ -647,15 +647,17 @@ static int bcm2835_pll_on(struct clk_hw
  	spin_unlock(&cprman->regs_lock);
  
  	/* Wait for the PLL to lock. */
diff --git a/target/linux/bcm27xx/patches-5.15/950-0149-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch b/target/linux/bcm27xx/patches-5.15/950-0149-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
index f35ca3f3a8..40523ef552 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0149-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0149-clk-bcm2835-Add-support-for-setting-leaf-clock-rates.patch
@@ -14,7 +14,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1109,15 +1109,19 @@ static int bcm2835_clock_set_rate(struct
+@@ -1139,15 +1139,19 @@ static int bcm2835_clock_set_rate(struct
  
  	spin_lock(&cprman->regs_lock);
  
@@ -42,7 +42,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
  	cprman_write(cprman, data->ctl_reg, ctl);
  
-@@ -1493,7 +1497,7 @@ static struct clk_hw *bcm2835_register_c
+@@ -1523,7 +1527,7 @@ static struct clk_hw *bcm2835_register_c
  		init.ops = &bcm2835_vpu_clock_clk_ops;
  	} else {
  		init.ops = &bcm2835_clock_clk_ops;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0150-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch b/target/linux/bcm27xx/patches-5.15/950-0150-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
index 4caf953ced..ee9bcc8517 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0150-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0150-clk-bcm2835-Allow-reparenting-leaf-clocks-while-they.patch
@@ -15,7 +15,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1098,8 +1098,10 @@ static int bcm2835_clock_on(struct clk_h
+@@ -1128,8 +1128,10 @@ static int bcm2835_clock_on(struct clk_h
  	return 0;
  }
  
@@ -28,7 +28,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  {
  	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
  	struct bcm2835_cprman *cprman = clock->cprman;
-@@ -1121,6 +1123,11 @@ static int bcm2835_clock_set_rate(struct
+@@ -1151,6 +1153,11 @@ static int bcm2835_clock_set_rate(struct
  		bcm2835_clock_wait_busy(clock);
  	}
  
@@ -40,7 +40,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  	ctl &= ~CM_FRAC;
  	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
  	cprman_write(cprman, data->ctl_reg, ctl);
-@@ -1132,6 +1139,12 @@ static int bcm2835_clock_set_rate(struct
+@@ -1162,6 +1169,12 @@ static int bcm2835_clock_set_rate(struct
  	return 0;
  }
  
@@ -53,7 +53,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  static bool
  bcm2835_clk_is_pllc(struct clk_hw *hw)
  {
-@@ -1315,6 +1328,7 @@ static const struct clk_ops bcm2835_cloc
+@@ -1345,6 +1358,7 @@ static const struct clk_ops bcm2835_cloc
  	.unprepare = bcm2835_clock_off,
  	.recalc_rate = bcm2835_clock_get_rate,
  	.set_rate = bcm2835_clock_set_rate,
@@ -61,7 +61,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  	.determine_rate = bcm2835_clock_determine_rate,
  	.set_parent = bcm2835_clock_set_parent,
  	.get_parent = bcm2835_clock_get_parent,
-@@ -1497,7 +1511,6 @@ static struct clk_hw *bcm2835_register_c
+@@ -1527,7 +1541,6 @@ static struct clk_hw *bcm2835_register_c
  		init.ops = &bcm2835_vpu_clock_clk_ops;
  	} else {
  		init.ops = &bcm2835_clock_clk_ops;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0152-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/bcm27xx/patches-5.15/950-0152-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
index 7fec7cb556..85f3e610ad 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0152-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0152-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1611,6 +1611,109 @@ command_cleanup:
+@@ -1612,6 +1612,109 @@ command_cleanup:
  }
  
  /*
@@ -125,7 +125,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -5436,6 +5539,7 @@ static const struct hc_driver xhci_hc_dr
+@@ -5437,6 +5540,7 @@ static const struct hc_driver xhci_hc_dr
  	.endpoint_reset =	xhci_endpoint_reset,
  	.check_bandwidth =	xhci_check_bandwidth,
  	.reset_bandwidth =	xhci_reset_bandwidth,
diff --git a/target/linux/bcm27xx/patches-5.15/950-0159-clk-bcm2835-Avoid-null-pointer-exception.patch b/target/linux/bcm27xx/patches-5.15/950-0159-clk-bcm2835-Avoid-null-pointer-exception.patch
index 092c7ecffc..ce32b6689c 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0159-clk-bcm2835-Avoid-null-pointer-exception.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0159-clk-bcm2835-Avoid-null-pointer-exception.patch
@@ -12,7 +12,7 @@ Signed-off-by: popcornmix <popcornmix@gmail.com>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2304,9 +2304,11 @@ static bool bcm2835_clk_is_claimed(const
+@@ -2335,9 +2335,11 @@ static bool bcm2835_clk_is_claimed(const
  	int i;
  
  	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
diff --git a/target/linux/bcm27xx/patches-5.15/950-0166-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-5.15/950-0166-xhci-Use-more-event-ring-segment-table-entries.patch
index e3f72fe95e..b3f8240db2 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0166-xhci-Use-more-event-ring-segment-table-entries.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0166-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci-mem.c
 +++ b/drivers/usb/host/xhci-mem.c
-@@ -2511,9 +2511,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2516,9 +2516,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	 * Event ring setup: Allocate a normal ring, but also setup
  	 * the event ring segment table (ERST).  Section 4.9.3.
  	 */
@@ -36,7 +36,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  	if (!xhci->event_ring)
  		goto fail;
  	if (xhci_check_trb_in_td_math(xhci) < 0)
-@@ -2526,7 +2528,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2531,7 +2533,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	/* set ERST count with the number of entries in the segment table */
  	val = readl(&xhci->ir_set->erst_size);
  	val &= ERST_SIZE_MASK;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0186-clk-bcm2835-Disable-v3d-clock.patch b/target/linux/bcm27xx/patches-5.15/950-0186-clk-bcm2835-Disable-v3d-clock.patch
index 21189080a7..230f423bfb 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0186-clk-bcm2835-Disable-v3d-clock.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0186-clk-bcm2835-Disable-v3d-clock.patch
@@ -12,7 +12,7 @@ Signed-off-by: popcornmix <popcornmix@gmail.com>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1735,16 +1735,12 @@ static const struct bcm2835_clk_desc clk
+@@ -1765,16 +1765,12 @@ static const struct bcm2835_clk_desc clk
  		.hold_mask = CM_PLLA_HOLDCORE,
  		.fixed_divider = 1,
  		.flags = CLK_SET_RATE_PARENT),
@@ -35,7 +35,7 @@ Signed-off-by: popcornmix <popcornmix@gmail.com>
  	[BCM2835_PLLA_DSI0]	= REGISTER_PLL_DIV(
  		SOC_ALL,
  		.name = "plla_dsi0",
-@@ -2045,14 +2041,12 @@ static const struct bcm2835_clk_desc clk
+@@ -2075,14 +2071,12 @@ static const struct bcm2835_clk_desc clk
  		.int_bits = 6,
  		.frac_bits = 0,
  		.tcnt_mux = 3),
diff --git a/target/linux/bcm27xx/patches-5.15/950-0190-Initialise-rpi-firmware-before-clk-bcm2835.patch b/target/linux/bcm27xx/patches-5.15/950-0190-Initialise-rpi-firmware-before-clk-bcm2835.patch
index 1f7c5a2e35..96451c9c75 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0190-Initialise-rpi-firmware-before-clk-bcm2835.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0190-Initialise-rpi-firmware-before-clk-bcm2835.patch
@@ -25,7 +25,7 @@ Co-authored-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2423,7 +2423,7 @@ static int __init __bcm2835_clk_driver_i
+@@ -2454,7 +2454,7 @@ static int __init __bcm2835_clk_driver_i
  {
  	return platform_driver_register(&bcm2835_clk_driver);
  }
diff --git a/target/linux/bcm27xx/patches-5.15/950-0208-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch b/target/linux/bcm27xx/patches-5.15/950-0208-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
index 7a72dc8576..b668a94790 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0208-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0208-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
@@ -32,7 +32,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -3478,6 +3478,7 @@ static int __spi_validate_bits_per_word(
+@@ -3480,6 +3480,7 @@ static int __spi_validate_bits_per_word(
   */
  int spi_setup(struct spi_device *spi)
  {
@@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	unsigned	bad_bits, ugly_bits;
  	int		status;
  
-@@ -3499,6 +3500,14 @@ int spi_setup(struct spi_device *spi)
+@@ -3501,6 +3502,14 @@ int spi_setup(struct spi_device *spi)
  		(SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL |
  		 SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
  		return -EINVAL;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0404-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch b/target/linux/bcm27xx/patches-5.15/950-0404-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch
index d0c4afe577..7f7ffa8ffd 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0404-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0404-clk-bcm2835-Pass-DT-node-to-rpi_firmware_get.patch
@@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2339,7 +2339,7 @@ static int bcm2835_clk_probe(struct plat
+@@ -2370,7 +2370,7 @@ static int bcm2835_clk_probe(struct plat
  
  	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
  	if (fw_node) {
diff --git a/target/linux/bcm27xx/patches-5.15/950-0446-drm-vc4-Fix-timings-for-VEC-modes.patch b/target/linux/bcm27xx/patches-5.15/950-0446-drm-vc4-Fix-timings-for-VEC-modes.patch
deleted file mode 100644
index 56b635d459..0000000000
--- a/target/linux/bcm27xx/patches-5.15/950-0446-drm-vc4-Fix-timings-for-VEC-modes.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From 3edc6e2d440803dfe22288c3ea7d77b4ab934ec8 Mon Sep 17 00:00:00 2001
-From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
-Date: Thu, 15 Jul 2021 01:07:30 +0200
-Subject: [PATCH] drm/vc4: Fix timings for VEC modes
-
-This commit fixes vertical timings of the VEC (composite output) modes
-to accurately represent the 525-line ("NTSC") and 625-line ("PAL") ITU-R
-standards.
-
-Previous timings were actually defined as 502 and 601 lines, resulting
-in non-standard 62.69 Hz and 52 Hz signals being generated,
-respectively.
-
-Changes to vc4_crtc.c have also been made, to make the PixelValve
-vertical timings accurately correspond to the DRM modeline in interlaced
-modes. The resulting VERTA/VERTB register values have been verified
-against the reference values set by the Raspberry Pi firmware.
-
-Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
----
- drivers/gpu/drm/vc4/vc4_crtc.c | 70 +++++++++++++++++++++-------------
- drivers/gpu/drm/vc4/vc4_vec.c  |  4 +-
- 2 files changed, 45 insertions(+), 29 deletions(-)
-
---- a/drivers/gpu/drm/vc4/vc4_crtc.c
-+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -318,8 +318,14 @@ static void vc4_crtc_config_pv(struct dr
- 	bool is_dsi = (vc4_encoder->type == VC4_ENCODER_TYPE_DSI0 ||
- 		       vc4_encoder->type == VC4_ENCODER_TYPE_DSI1);
- 	bool is_dsi1 = vc4_encoder->type == VC4_ENCODER_TYPE_DSI1;
-+	bool is_vec = vc4_encoder->type == VC4_ENCODER_TYPE_VEC;
- 	u32 format = is_dsi1 ? PV_CONTROL_FORMAT_DSIV_24 : PV_CONTROL_FORMAT_24;
- 	u8 ppc = pv_data->pixels_per_clock;
-+
-+	u16 vert_bp = mode->crtc_vtotal - mode->crtc_vsync_end;
-+	u16 vert_sync = mode->crtc_vsync_end - mode->crtc_vsync_start;
-+	u16 vert_fp = mode->crtc_vsync_start - mode->crtc_vdisplay;
-+
- 	bool debug_dump_regs = false;
- 
- 	if (debug_dump_regs) {
-@@ -343,49 +349,59 @@ static void vc4_crtc_config_pv(struct dr
- 		   VC4_SET_FIELD(mode->hdisplay * pixel_rep / ppc,
- 				 PV_HORZB_HACTIVE));
- 
--	CRTC_WRITE(PV_VERTA,
--		   VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end +
--				 interlace,
--				 PV_VERTA_VBP) |
--		   VC4_SET_FIELD(mode->crtc_vsync_end - mode->crtc_vsync_start,
--				 PV_VERTA_VSYNC));
--	CRTC_WRITE(PV_VERTB,
--		   VC4_SET_FIELD(mode->crtc_vsync_start - mode->crtc_vdisplay,
--				 PV_VERTB_VFP) |
--		   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
--
- 	if (interlace) {
-+		bool odd_field_first = false;
-+		u32 field_delay = mode->htotal * pixel_rep / (2 * ppc);
-+		u16 vert_bp_even = vert_bp;
-+		u16 vert_fp_even = vert_fp;
-+
-+		if (is_vec) {
-+			/* VEC (composite output) */
-+			++field_delay;
-+			if (mode->htotal == 858) {
-+				/* 525-line mode (NTSC or PAL-M) */
-+				odd_field_first = true;
-+			}
-+		}
-+
-+		if (odd_field_first)
-+			++vert_fp_even;
-+		else
-+			++vert_bp;
-+
- 		CRTC_WRITE(PV_VERTA_EVEN,
--			   VC4_SET_FIELD(mode->crtc_vtotal -
--					 mode->crtc_vsync_end,
--					 PV_VERTA_VBP) |
--			   VC4_SET_FIELD(mode->crtc_vsync_end -
--					 mode->crtc_vsync_start,
--					 PV_VERTA_VSYNC));
-+			   VC4_SET_FIELD(vert_bp_even, PV_VERTA_VBP) |
-+			   VC4_SET_FIELD(vert_sync, PV_VERTA_VSYNC));
- 		CRTC_WRITE(PV_VERTB_EVEN,
--			   VC4_SET_FIELD(mode->crtc_vsync_start -
--					 mode->crtc_vdisplay,
--					 PV_VERTB_VFP) |
-+			   VC4_SET_FIELD(vert_fp_even, PV_VERTB_VFP) |
- 			   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
- 
--		/* We set up first field even mode for HDMI.  VEC's
--		 * NTSC mode would want first field odd instead, once
--		 * we support it (to do so, set ODD_FIRST and put the
--		 * delay in VSYNCD_EVEN instead).
-+		/* We set up first field even mode for HDMI and VEC's PAL.
-+		 * For NTSC, we need first field odd.
- 		 */
- 		CRTC_WRITE(PV_V_CONTROL,
- 			   PV_VCONTROL_CONTINUOUS |
- 			   (is_dsi ? PV_VCONTROL_DSI : 0) |
- 			   PV_VCONTROL_INTERLACE |
--			   VC4_SET_FIELD(mode->htotal * pixel_rep / (2 * ppc),
--					 PV_VCONTROL_ODD_DELAY));
--		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
-+			   (odd_field_first
-+				   ? PV_VCONTROL_ODD_FIRST
-+				   : VC4_SET_FIELD(field_delay,
-+						   PV_VCONTROL_ODD_DELAY)));
-+		CRTC_WRITE(PV_VSYNCD_EVEN,
-+			   (odd_field_first ? field_delay : 0));
- 	} else {
- 		CRTC_WRITE(PV_V_CONTROL,
- 			   PV_VCONTROL_CONTINUOUS |
- 			   (is_dsi ? PV_VCONTROL_DSI : 0));
- 	}
- 
-+	CRTC_WRITE(PV_VERTA,
-+		   VC4_SET_FIELD(vert_bp, PV_VERTA_VBP) |
-+		   VC4_SET_FIELD(vert_sync, PV_VERTA_VSYNC));
-+	CRTC_WRITE(PV_VERTB,
-+		   VC4_SET_FIELD(vert_fp, PV_VERTB_VFP) |
-+		   VC4_SET_FIELD(mode->crtc_vdisplay, PV_VERTB_VACTIVE));
-+
- 	if (is_dsi)
- 		CRTC_WRITE(PV_HACT_ACT, mode->hdisplay * pixel_rep);
- 
---- a/drivers/gpu/drm/vc4/vc4_vec.c
-+++ b/drivers/gpu/drm/vc4/vc4_vec.c
-@@ -256,7 +256,7 @@ static void vc4_vec_ntsc_j_mode_set(stru
- static const struct drm_display_mode ntsc_mode = {
- 	DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 13500,
- 		 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
--		 480, 480 + 3, 480 + 3 + 3, 480 + 3 + 3 + 16, 0,
-+		 480, 480 + 7, 480 + 7 + 6, 525, 0,
- 		 DRM_MODE_FLAG_INTERLACE)
- };
- 
-@@ -278,7 +278,7 @@ static void vc4_vec_pal_m_mode_set(struc
- static const struct drm_display_mode pal_mode = {
- 	DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 13500,
- 		 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
--		 576, 576 + 2, 576 + 2 + 3, 576 + 2 + 3 + 20, 0,
-+		 576, 576 + 4, 576 + 4 + 6, 625, 0,
- 		 DRM_MODE_FLAG_INTERLACE)
- };
- 
diff --git a/target/linux/bcm27xx/patches-5.15/950-0470-sound-usb-add-device-quirks-for-A4Tech-FHD-1080p-web.patch b/target/linux/bcm27xx/patches-5.15/950-0470-sound-usb-add-device-quirks-for-A4Tech-FHD-1080p-web.patch
index 9f0aa6fcd4..c1f31d65dc 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0470-sound-usb-add-device-quirks-for-A4Tech-FHD-1080p-web.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0470-sound-usb-add-device-quirks-for-A4Tech-FHD-1080p-web.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/sound/usb/quirks.c
 +++ b/sound/usb/quirks.c
-@@ -1925,6 +1925,8 @@ static const struct usb_audio_quirk_flag
+@@ -1883,6 +1883,8 @@ static const struct usb_audio_quirk_flag
  		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
  	DEVICE_FLG(0x2b53, 0x0031, /* Fiero SC-01 (firmware v1.1.0) */
  		   QUIRK_FLAG_GENERIC_IMPLICIT_FB),
diff --git a/target/linux/bcm27xx/patches-5.15/950-0471-sound-usb-call-usb_autopm_get_interface-for-devices-.patch b/target/linux/bcm27xx/patches-5.15/950-0471-sound-usb-call-usb_autopm_get_interface-for-devices-.patch
index b195163196..5ca57a6b0a 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0471-sound-usb-call-usb_autopm_get_interface-for-devices-.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0471-sound-usb-call-usb_autopm_get_interface-for-devices-.patch
@@ -19,7 +19,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/sound/usb/card.c
 +++ b/sound/usb/card.c
-@@ -825,8 +825,14 @@ static int usb_audio_probe(struct usb_in
+@@ -843,8 +843,14 @@ static int usb_audio_probe(struct usb_in
  	if (ignore_ctl_error)
  		chip->quirk_flags |= QUIRK_FLAG_IGNORE_CTL_ERROR;
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0550-clk-bcm2835-Remove-VEC-clock-support.patch b/target/linux/bcm27xx/patches-5.15/950-0550-clk-bcm2835-Remove-VEC-clock-support.patch
index dc198ebbcc..b85b2474b2 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0550-clk-bcm2835-Remove-VEC-clock-support.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0550-clk-bcm2835-Remove-VEC-clock-support.patch
@@ -10,9 +10,9 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2208,21 +2208,6 @@ static const struct bcm2835_clk_desc clk
- 		.frac_bits = 12,
- 		.tcnt_mux = 28),
+@@ -2239,21 +2239,6 @@ static const struct bcm2835_clk_desc clk
+ 		.tcnt_mux = 28,
+ 		.round_up = true),
  
 -	/* TV encoder clock.  Only operating frequency is 108Mhz.  */
 -	[BCM2835_CLOCK_VEC]	= REGISTER_PER_CLK(
diff --git a/target/linux/bcm27xx/patches-5.15/950-0551-drm-vc4-Add-support-for-gamma-on-BCM2711.patch b/target/linux/bcm27xx/patches-5.15/950-0551-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
index 38fbdd0aa1..555636515c 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0551-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0551-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
@@ -24,7 +24,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -1164,19 +1164,42 @@ int vc4_crtc_init(struct drm_device *drm
+@@ -1148,19 +1148,42 @@ int vc4_crtc_init(struct drm_device *drm
  
  	if (!vc4->hvs->hvs5) {
  		drm_mode_crtc_set_gamma_size(crtc, ARRAY_SIZE(vc4_crtc->lut_r));
diff --git a/target/linux/bcm27xx/patches-5.15/950-0555-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch b/target/linux/bcm27xx/patches-5.15/950-0555-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch
index 51fac0e0d4..72c5c2085d 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0555-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0555-drm-vc4-Relax-VEC-modeline-requirements-and-add-prog.patch
@@ -17,14 +17,14 @@ Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -410,6 +410,7 @@ static void vc4_crtc_config_pv(struct dr
+@@ -401,6 +401,7 @@ static void vc4_crtc_config_pv(struct dr
  		CRTC_WRITE(PV_V_CONTROL,
  			   PV_VCONTROL_CONTINUOUS |
  			   (is_dsi ? PV_VCONTROL_DSI : 0));
 +		CRTC_WRITE(PV_VSYNCD_EVEN, 0);
  	}
  
- 	CRTC_WRITE(PV_VERTA,
+ 	if (is_dsi)
 --- a/drivers/gpu/drm/vc4/vc4_vec.c
 +++ b/drivers/gpu/drm/vc4/vc4_vec.c
 @@ -423,18 +423,11 @@ static int vc4_vec_connector_atomic_chec
diff --git a/target/linux/bcm27xx/patches-5.15/950-0569-drm-vc4-Only-add-gamma-properties-once.patch b/target/linux/bcm27xx/patches-5.15/950-0569-drm-vc4-Only-add-gamma-properties-once.patch
index 0c7e76d463..0ad28fa0e1 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0569-drm-vc4-Only-add-gamma-properties-once.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0569-drm-vc4-Only-add-gamma-properties-once.patch
@@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -1196,7 +1196,7 @@ int vc4_crtc_init(struct drm_device *drm
+@@ -1180,7 +1180,7 @@ int vc4_crtc_init(struct drm_device *drm
  		/* We support CTM, but only for one CRTC at a time. It's therefore
  		 * implemented as private driver state in vc4_kms, not here.
  		 */
diff --git a/target/linux/bcm27xx/patches-5.15/950-0600-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/target/linux/bcm27xx/patches-5.15/950-0600-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
index 87de92c62a..6c2840d633 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0600-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0600-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -50,11 +50,11 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1903,6 +1903,7 @@ struct xhci_hcd {
- #define XHCI_NO_SOFT_RETRY	BIT_ULL(40)
+@@ -1904,6 +1904,7 @@ struct xhci_hcd {
  #define XHCI_BROKEN_D3COLD	BIT_ULL(41)
  #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
-+#define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(43)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
++#define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(44)
  
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0605-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch b/target/linux/bcm27xx/patches-5.15/950-0605-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch
index e6d2bcebb5..2b7435368a 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0605-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0605-xhci-refactor-out-TRBS_PER_SEGMENT-define-in-runtime.patch
@@ -145,7 +145,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (ret)
  		return -ENOMEM;
  
-@@ -1811,7 +1815,7 @@ int xhci_alloc_erst(struct xhci_hcd *xhc
+@@ -1816,7 +1820,7 @@ int xhci_alloc_erst(struct xhci_hcd *xhc
  	for (val = 0; val < evt_ring->num_segs; val++) {
  		entry = &erst->entries[val];
  		entry->seg_addr = cpu_to_le64(seg->dma);
diff --git a/target/linux/bcm27xx/patches-5.15/950-0606-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch b/target/linux/bcm27xx/patches-5.15/950-0606-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch
index 5c64c9881d..39ddab76e8 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0606-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0606-usb-xhci-add-VLI_TRB_CACHE_BUG-quirk.patch
@@ -63,11 +63,11 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1905,6 +1905,7 @@ struct xhci_hcd {
- #define XHCI_BROKEN_D3COLD	BIT_ULL(41)
+@@ -1906,6 +1906,7 @@ struct xhci_hcd {
  #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
- #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(43)
-+#define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(44)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(44)
++#define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(45)
  
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0654-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch b/target/linux/bcm27xx/patches-5.15/950-0654-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch
index 80edae5cf5..91363766aa 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0654-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0654-drm-vc4-Disable-Gamma-control-on-HVS5-due-to-issues-.patch
@@ -17,7 +17,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -1182,15 +1182,9 @@ int vc4_crtc_init(struct drm_device *drm
+@@ -1166,15 +1166,9 @@ int vc4_crtc_init(struct drm_device *drm
  
  	if (!vc4->hvs->hvs5) {
  		drm_mode_crtc_set_gamma_size(crtc, ARRAY_SIZE(vc4_crtc->lut_r));
diff --git a/target/linux/bcm27xx/patches-5.15/950-0717-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch b/target/linux/bcm27xx/patches-5.15/950-0717-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch
index 74c8a4db98..ab68debd2f 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0717-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0717-usb-xhci-add-a-quirk-for-Superspeed-bulk-OUT-transfe.patch
@@ -86,11 +86,11 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  			first_trb = false;
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1906,6 +1906,7 @@ struct xhci_hcd {
- #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
- #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(43)
- #define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(44)
-+#define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(45)
+@@ -1907,6 +1907,7 @@ struct xhci_hcd {
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
+ #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(44)
+ #define XHCI_VLI_TRB_CACHE_BUG	BIT_ULL(45)
++#define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(46)
  
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm27xx/patches-5.15/950-0741-drm-vc4-hvs-Use-pointer-to-HVS-in-HVS_READ-and-HVS_W.patch b/target/linux/bcm27xx/patches-5.15/950-0741-drm-vc4-hvs-Use-pointer-to-HVS-in-HVS_READ-and-HVS_W.patch
index 5fd8ea995a..aa82f3c7e1 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0741-drm-vc4-hvs-Use-pointer-to-HVS-in-HVS_READ-and-HVS_W.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0741-drm-vc4-hvs-Use-pointer-to-HVS-in-HVS_READ-and-HVS_W.patch
@@ -45,7 +45,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  			*hpos += mode->crtc_htotal / 2;
  	}
  
-@@ -449,6 +451,7 @@ static void vc4_crtc_config_pv(struct dr
+@@ -433,6 +435,7 @@ static void vc4_crtc_config_pv(struct dr
  static void require_hvs_enabled(struct drm_device *dev)
  {
  	struct vc4_dev *vc4 = to_vc4_dev(dev);
@@ -53,7 +53,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	WARN_ON_ONCE((HVS_READ(SCALER_DISPCTRL) & SCALER_DISPCTRL_ENABLE) !=
  		     SCALER_DISPCTRL_ENABLE);
-@@ -462,6 +465,7 @@ static int vc4_crtc_disable(struct drm_c
+@@ -446,6 +449,7 @@ static int vc4_crtc_disable(struct drm_c
  	struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
  	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
  	struct drm_device *dev = crtc->dev;
@@ -61,7 +61,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	int ret;
  
  	CRTC_WRITE(PV_V_CONTROL,
-@@ -491,7 +495,7 @@ static int vc4_crtc_disable(struct drm_c
+@@ -475,7 +479,7 @@ static int vc4_crtc_disable(struct drm_c
  		vc4_encoder->post_crtc_disable(encoder, state);
  
  	vc4_crtc_pixelvalve_reset(crtc);
@@ -70,7 +70,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	if (vc4_encoder && vc4_encoder->post_crtc_powerdown)
  		vc4_encoder->post_crtc_powerdown(encoder, state);
-@@ -517,6 +521,7 @@ static struct drm_encoder *vc4_crtc_get_
+@@ -501,6 +505,7 @@ static struct drm_encoder *vc4_crtc_get_
  int vc4_crtc_disable_at_boot(struct drm_crtc *crtc)
  {
  	struct drm_device *drm = crtc->dev;
@@ -78,7 +78,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
  	enum vc4_encoder_type encoder_type;
  	const struct vc4_pv_data *pv_data;
-@@ -538,7 +543,7 @@ int vc4_crtc_disable_at_boot(struct drm_
+@@ -522,7 +527,7 @@ int vc4_crtc_disable_at_boot(struct drm_
  	if (!(CRTC_READ(PV_V_CONTROL) & PV_VCONTROL_VIDEN))
  		return 0;
  
@@ -87,7 +87,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (channel < 0)
  		return 0;
  
-@@ -754,6 +759,7 @@ static void vc4_crtc_handle_page_flip(st
+@@ -738,6 +743,7 @@ static void vc4_crtc_handle_page_flip(st
  	struct drm_crtc *crtc = &vc4_crtc->base;
  	struct drm_device *dev = crtc->dev;
  	struct vc4_dev *vc4 = to_vc4_dev(dev);
@@ -95,7 +95,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	u32 chan = vc4_crtc->current_hvs_channel;
  	unsigned long flags;
  
-@@ -772,7 +778,7 @@ static void vc4_crtc_handle_page_flip(st
+@@ -756,7 +762,7 @@ static void vc4_crtc_handle_page_flip(st
  		 * the CRTC and encoder already reconfigured, leading to
  		 * underruns. This can be seen when reconfiguring the CRTC.
  		 */
diff --git a/target/linux/bcm27xx/patches-5.15/950-0742-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch b/target/linux/bcm27xx/patches-5.15/950-0742-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
index c6efd540ad..8f69962640 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0742-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0742-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
@@ -80,7 +80,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -959,14 +959,8 @@ void vc4_crtc_destroy_state(struct drm_c
+@@ -943,14 +943,8 @@ void vc4_crtc_destroy_state(struct drm_c
  	struct vc4_dev *vc4 = to_vc4_dev(crtc->dev);
  	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0753-drm-vc4-Fix-out-of-order-frames-during-asynchronous-.patch b/target/linux/bcm27xx/patches-5.15/950-0753-drm-vc4-Fix-out-of-order-frames-during-asynchronous-.patch
index a5505849e6..1f765aeb04 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0753-drm-vc4-Fix-out-of-order-frames-during-asynchronous-.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0753-drm-vc4-Fix-out-of-order-frames-during-asynchronous-.patch
@@ -37,7 +37,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -813,6 +813,7 @@ struct vc4_async_flip_state {
+@@ -797,6 +797,7 @@ struct vc4_async_flip_state {
  	struct drm_pending_vblank_event *event;
  
  	struct vc4_seqno_cb cb;
@@ -45,7 +45,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  };
  
  /* Called when the V3D execution for the BO being flipped to is done, so that
-@@ -858,6 +859,39 @@ vc4_async_page_flip_complete(struct vc4_
+@@ -842,6 +843,39 @@ vc4_async_page_flip_complete(struct vc4_
  	kfree(flip_state);
  }
  
@@ -85,7 +85,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  /* Implements async (non-vblank-synced) page flips.
   *
   * The page flip ioctl needs to return immediately, so we grab the
-@@ -918,8 +952,7 @@ static int vc4_async_page_flip(struct dr
+@@ -902,8 +936,7 @@ static int vc4_async_page_flip(struct dr
  	 */
  	drm_atomic_set_fb_for_plane(plane->state, fb);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0805-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch b/target/linux/bcm27xx/patches-5.15/950-0805-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
index 44fb34b37b..7ff4c0f06f 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0805-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0805-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
@@ -19,7 +19,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -728,10 +728,16 @@ static int vc4_crtc_atomic_check(struct
+@@ -712,10 +712,16 @@ static int vc4_crtc_atomic_check(struct
  		if (conn_state->crtc != crtc)
  			continue;
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0807-Revert-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch b/target/linux/bcm27xx/patches-5.15/950-0807-Revert-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
index 65eddde794..9a14da02b1 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0807-Revert-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0807-Revert-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
@@ -13,7 +13,7 @@ This reverts commit e99a1b69da07ee3b89a6b8005b854e6c04bfb450.
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -998,8 +998,14 @@ void vc4_crtc_destroy_state(struct drm_c
+@@ -982,8 +982,14 @@ void vc4_crtc_destroy_state(struct drm_c
  	struct vc4_dev *vc4 = to_vc4_dev(crtc->dev);
  	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0873-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch b/target/linux/bcm27xx/patches-5.15/950-0873-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch
index 6ab0df5954..8557609376 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0873-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0873-clk-bcm2835-use-subsys_initcall-for-the-clock-driver.patch
@@ -14,7 +14,7 @@ Signed-off-by: Alberto Solavagione <albertosolavagione30@gmail.com>
 
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -2408,7 +2408,11 @@ static int __init __bcm2835_clk_driver_i
+@@ -2439,7 +2439,11 @@ static int __init __bcm2835_clk_driver_i
  {
  	return platform_driver_register(&bcm2835_clk_driver);
  }
diff --git a/target/linux/bcm27xx/patches-5.15/950-0898-drm-vc4-Consolidate-Hardware-Revision-Check.patch b/target/linux/bcm27xx/patches-5.15/950-0898-drm-vc4-Consolidate-Hardware-Revision-Check.patch
index ac22a96c3f..8699bed008 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0898-drm-vc4-Consolidate-Hardware-Revision-Check.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0898-drm-vc4-Consolidate-Hardware-Revision-Check.patch
@@ -32,7 +32,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  			return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX - 1;
  
  		return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX;
-@@ -425,7 +425,7 @@ static void vc4_crtc_config_pv(struct dr
+@@ -409,7 +409,7 @@ static void vc4_crtc_config_pv(struct dr
  	if (is_dsi)
  		CRTC_WRITE(PV_HACT_ACT, mode->hdisplay * pixel_rep);
  
@@ -41,7 +41,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		CRTC_WRITE(PV_MUX_CFG,
  			   VC4_SET_FIELD(PV_MUX_CFG_RGB_PIXEL_MUX_MODE_NO_SWAP,
  					 PV_MUX_CFG_RGB_PIXEL_MUX_MODE));
-@@ -883,7 +883,7 @@ static int vc4_async_set_fence_cb(struct
+@@ -867,7 +867,7 @@ static int vc4_async_set_fence_cb(struct
  	struct vc4_dev *vc4 = to_vc4_dev(dev);
  	struct dma_fence *fence;
  
@@ -50,7 +50,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		struct vc4_bo *bo = to_vc4_bo(&cma_bo->base);
  
  		return vc4_queue_seqno_cb(dev, &flip_state->cb, bo->seqno,
-@@ -1225,13 +1225,13 @@ int vc4_crtc_init(struct drm_device *drm
+@@ -1209,13 +1209,13 @@ int vc4_crtc_init(struct drm_device *drm
  				  crtc_funcs, NULL);
  	drm_crtc_helper_add(crtc, crtc_helper_funcs);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0905-drm-vc4-crtc-Use-an-union-to-store-the-page-flip-cal.patch b/target/linux/bcm27xx/patches-5.15/950-0905-drm-vc4-crtc-Use-an-union-to-store-the-page-flip-cal.patch
index ef92e7b2aa..9d03e60f5a 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0905-drm-vc4-crtc-Use-an-union-to-store-the-page-flip-cal.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0905-drm-vc4-crtc-Use-an-union-to-store-the-page-flip-cal.patch
@@ -15,7 +15,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -818,18 +818,18 @@ struct vc4_async_flip_state {
+@@ -802,18 +802,18 @@ struct vc4_async_flip_state {
  	struct drm_framebuffer *old_fb;
  	struct drm_pending_vblank_event *event;
  
@@ -39,7 +39,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct drm_crtc *crtc = flip_state->crtc;
  	struct drm_device *dev = crtc->dev;
  	struct drm_plane *plane = crtc->primary;
-@@ -865,13 +865,21 @@ vc4_async_page_flip_complete(struct vc4_
+@@ -849,13 +849,21 @@ vc4_async_page_flip_complete(struct vc4_
  	kfree(flip_state);
  }
  
@@ -63,7 +63,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	dma_fence_put(fence);
  }
  
-@@ -886,14 +894,14 @@ static int vc4_async_set_fence_cb(struct
+@@ -870,14 +878,14 @@ static int vc4_async_set_fence_cb(struct
  	if (!vc4->is_vc5) {
  		struct vc4_bo *bo = to_vc4_bo(&cma_bo->base);
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0906-drm-vc4-crtc-Move-the-BO-handling-out-of-common-page.patch b/target/linux/bcm27xx/patches-5.15/950-0906-drm-vc4-crtc-Move-the-BO-handling-out-of-common-page.patch
index 958f4e8d38..a3a291d97e 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0906-drm-vc4-crtc-Move-the-BO-handling-out-of-common-page.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0906-drm-vc4-crtc-Move-the-BO-handling-out-of-common-page.patch
@@ -15,7 +15,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -846,21 +846,8 @@ vc4_async_page_flip_complete(struct vc4_
+@@ -830,21 +830,8 @@ vc4_async_page_flip_complete(struct vc4_
  	drm_crtc_vblank_put(crtc);
  	drm_framebuffer_put(flip_state->fb);
  
@@ -38,7 +38,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	kfree(flip_state);
  }
-@@ -869,8 +856,27 @@ static void vc4_async_page_flip_seqno_co
+@@ -853,8 +840,27 @@ static void vc4_async_page_flip_seqno_co
  {
  	struct vc4_async_flip_state *flip_state =
  		container_of(cb, struct vc4_async_flip_state, cb.seqno);
diff --git a/target/linux/bcm27xx/patches-5.15/950-0907-drm-vc4-crtc-Move-the-BO-Handling-out-of-Common-Page.patch b/target/linux/bcm27xx/patches-5.15/950-0907-drm-vc4-crtc-Move-the-BO-Handling-out-of-Common-Page.patch
index d3b680a56c..1c60667be6 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0907-drm-vc4-crtc-Move-the-BO-Handling-out-of-Common-Page.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0907-drm-vc4-crtc-Move-the-BO-Handling-out-of-Common-Page.patch
@@ -20,7 +20,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -912,40 +912,19 @@ static int vc4_async_set_fence_cb(struct
+@@ -896,40 +896,19 @@ static int vc4_async_set_fence_cb(struct
  	return 0;
  }
  
@@ -67,7 +67,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	drm_framebuffer_get(fb);
  	flip_state->fb = fb;
-@@ -978,6 +957,48 @@ static int vc4_async_page_flip(struct dr
+@@ -962,6 +941,48 @@ static int vc4_async_page_flip(struct dr
  	return 0;
  }
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0908-drm-vc4-crtc-Don-t-call-into-BO-Handling-on-Async-Pa.patch b/target/linux/bcm27xx/patches-5.15/950-0908-drm-vc4-crtc-Don-t-call-into-BO-Handling-on-Async-Pa.patch
index 96941cb20f..c935dda7c3 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0908-drm-vc4-crtc-Don-t-call-into-BO-Handling-on-Async-Pa.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0908-drm-vc4-crtc-Don-t-call-into-BO-Handling-on-Async-Pa.patch
@@ -15,7 +15,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_crtc.c
 +++ b/drivers/gpu/drm/vc4/vc4_crtc.c
-@@ -999,16 +999,31 @@ static int vc4_async_page_flip(struct dr
+@@ -983,16 +983,31 @@ static int vc4_async_page_flip(struct dr
  	return 0;
  }
  
diff --git a/target/linux/bcm27xx/patches-5.15/950-0914-mmc-block-Don-t-do-single-sector-reads-during-recove.patch b/target/linux/bcm27xx/patches-5.15/950-0914-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
index 94ddf5229c..7390813f30 100644
--- a/target/linux/bcm27xx/patches-5.15/950-0914-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
+++ b/target/linux/bcm27xx/patches-5.15/950-0914-mmc-block-Don-t-do-single-sector-reads-during-recove.patch
@@ -23,7 +23,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/block.c
 +++ b/drivers/mmc/core/block.c
-@@ -1870,7 +1870,11 @@ static void mmc_blk_mq_rw_recovery(struc
+@@ -1875,7 +1875,11 @@ static void mmc_blk_mq_rw_recovery(struc
  		return;
  	}
  
diff --git a/target/linux/bcm4908/patches-5.10/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch b/target/linux/bcm4908/patches-5.10/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch
new file mode 100644
index 0000000000..03e546cb5f
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.10/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch
@@ -0,0 +1,34 @@
+From 62a3106697f3c6f9af64a2cd0f9ff58552010dc8 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Wed, 22 Dec 2021 00:39:37 +0000
+Subject: [PATCH] net: broadcom: bcm4908enet: remove redundant variable bytes
+
+The variable bytes is being used to summate slot lengths,
+however the value is never used afterwards. The summation
+is redundant so remove variable bytes.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20211222003937.727325-1-colin.i.king@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -634,7 +634,6 @@ static int bcm4908_enet_poll_tx(struct n
+ 	struct bcm4908_enet_dma_ring_bd *buf_desc;
+ 	struct bcm4908_enet_dma_ring_slot *slot;
+ 	struct device *dev = enet->dev;
+-	unsigned int bytes = 0;
+ 	int handled = 0;
+ 
+ 	while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
+@@ -645,7 +644,6 @@ static int bcm4908_enet_poll_tx(struct n
+ 
+ 		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
+ 		dev_kfree_skb(slot->skb);
+-		bytes += slot->len;
+ 		if (++tx_ring->read_idx == tx_ring->length)
+ 			tx_ring->read_idx = 0;
+ 
diff --git a/target/linux/bcm4908/patches-5.10/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch b/target/linux/bcm4908/patches-5.10/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
similarity index 92%
rename from target/linux/bcm4908/patches-5.10/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
rename to target/linux/bcm4908/patches-5.10/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
index 702b7641fd..a6eba111f9 100644
--- a/target/linux/bcm4908/patches-5.10/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
+++ b/target/linux/bcm4908/patches-5.10/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
 +++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
-@@ -714,7 +714,9 @@ static int bcm4908_enet_probe(struct pla
+@@ -712,7 +712,9 @@ static int bcm4908_enet_probe(struct pla
  		return err;
  
  	SET_NETDEV_DEV(netdev, &pdev->dev);
@@ -31,7 +31,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	if (!is_valid_ether_addr(netdev->dev_addr))
  		eth_hw_addr_random(netdev);
  	netdev->netdev_ops = &bcm4908_enet_netdev_ops;
-@@ -725,14 +727,17 @@ static int bcm4908_enet_probe(struct pla
+@@ -723,14 +725,17 @@ static int bcm4908_enet_probe(struct pla
  	netif_napi_add(netdev, &enet->rx_ring.napi, bcm4908_enet_poll_rx, NAPI_POLL_WEIGHT);
  
  	err = register_netdev(netdev);
diff --git a/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch b/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch
new file mode 100644
index 0000000000..29cf3742f4
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch
@@ -0,0 +1,65 @@
+From ef3556ee16c68735ec69bd08df41d1cd83b14ad3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 27 Oct 2022 13:24:30 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: update TX stats after actual
+ transmission
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Queueing packets doesn't guarantee their transmission. Update TX stats
+after hardware confirms consuming submitted data.
+
+This also fixes a possible race and NULL dereference.
+bcm4908_enet_start_xmit() could try to access skb after freeing it in
+the bcm4908_enet_poll_tx().
+
+Reported-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -560,8 +560,6 @@ static int bcm4908_enet_start_xmit(struc
+ 
+ 	if (++ring->write_idx == ring->length - 1)
+ 		ring->write_idx = 0;
+-	enet->netdev->stats.tx_bytes += skb->len;
+-	enet->netdev->stats.tx_packets++;
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -634,6 +632,7 @@ static int bcm4908_enet_poll_tx(struct n
+ 	struct bcm4908_enet_dma_ring_bd *buf_desc;
+ 	struct bcm4908_enet_dma_ring_slot *slot;
+ 	struct device *dev = enet->dev;
++	unsigned int bytes = 0;
+ 	int handled = 0;
+ 
+ 	while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
+@@ -644,12 +643,17 @@ static int bcm4908_enet_poll_tx(struct n
+ 
+ 		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
+ 		dev_kfree_skb(slot->skb);
+-		if (++tx_ring->read_idx == tx_ring->length)
+-			tx_ring->read_idx = 0;
+ 
+ 		handled++;
++		bytes += slot->len;
++
++		if (++tx_ring->read_idx == tx_ring->length)
++			tx_ring->read_idx = 0;
+ 	}
+ 
++	enet->netdev->stats.tx_packets += handled;
++	enet->netdev->stats.tx_bytes += bytes;
++
+ 	if (handled < weight) {
+ 		napi_complete_done(napi, handled);
+ 		bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);
diff --git a/target/linux/bcm4908/patches-5.10/079-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch b/target/linux/bcm4908/patches-5.10/079-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch
new file mode 100644
index 0000000000..834973f5c7
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.10/079-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch
@@ -0,0 +1,152 @@
+From 3a1cc23a75abcd9cea585eb84846507363d58397 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 25 Oct 2022 15:22:45 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: use build_skb()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RX code can be more efficient with the build_skb(). Allocating actual
+SKB around eth packet buffer - right before passing it up - results in
+a better cache usage.
+
+Without RPS (echo 0 > rps_cpus) BCM4908 NAT masq performance "jumps"
+between two speeds: ~900 Mbps and 940 Mbps (it's a 4 CPUs SoC). This
+change bumps the lower speed from 905 Mb/s to 918 Mb/s (tested using
+single stream iperf 2.0.5 traffic).
+
+There are more optimizations to consider. One obvious to try is GRO
+however as BCM4908 doesn't do hw csum is may actually lower performance.
+Sometimes. Some early testing:
+
+┌─────────────────────────────────┬─────────────────────┬────────────────────┐
+│                                 │ netif_receive_skb() │ napi_gro_receive() │
+├─────────────────────────────────┼─────────────────────┼────────────────────┤
+│ netdev_alloc_skb()              │            905 Mb/s │           892 Mb/s │
+│ napi_alloc_frag() + build_skb() │            918 Mb/s │           917 Mb/s │
+└─────────────────────────────────┴─────────────────────┴────────────────────┘
+
+Another ideas:
+1. napi_build_skb()
+2. skb_copy_from_linear_data() for small packets
+
+Those need proper testing first though. That can be done later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20221025132245.22871-1-zajec5@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 53 +++++++++++++-------
+ 1 file changed, 36 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -36,13 +36,24 @@
+ #define ENET_MAX_ETH_OVERHEAD			(ETH_HLEN + BRCM_MAX_TAG_LEN + VLAN_HLEN + \
+ 						 ETH_FCS_LEN + 4) /* 32 */
+ 
++#define ENET_RX_SKB_BUF_SIZE			(NET_SKB_PAD + NET_IP_ALIGN + \
++						 ETH_HLEN + BRCM_MAX_TAG_LEN + VLAN_HLEN + \
++						 ENET_MTU_MAX + ETH_FCS_LEN + 4)
++#define ENET_RX_SKB_BUF_ALLOC_SIZE		(SKB_DATA_ALIGN(ENET_RX_SKB_BUF_SIZE) + \
++						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define ENET_RX_BUF_DMA_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN)
++#define ENET_RX_BUF_DMA_SIZE			(ENET_RX_SKB_BUF_SIZE - ENET_RX_BUF_DMA_OFFSET)
++
+ struct bcm4908_enet_dma_ring_bd {
+ 	__le32 ctl;
+ 	__le32 addr;
+ } __packed;
+ 
+ struct bcm4908_enet_dma_ring_slot {
+-	struct sk_buff *skb;
++	union {
++		void *buf;			/* RX */
++		struct sk_buff *skb;		/* TX */
++	};
+ 	unsigned int len;
+ 	dma_addr_t dma_addr;
+ };
+@@ -259,22 +270,21 @@ static int bcm4908_enet_dma_alloc_rx_buf
+ 	u32 tmp;
+ 	int err;
+ 
+-	slot->len = ENET_MTU_MAX + ENET_MAX_ETH_OVERHEAD;
+-
+-	slot->skb = netdev_alloc_skb(enet->netdev, slot->len);
+-	if (!slot->skb)
++	slot->buf = napi_alloc_frag(ENET_RX_SKB_BUF_ALLOC_SIZE);
++	if (!slot->buf)
+ 		return -ENOMEM;
+ 
+-	slot->dma_addr = dma_map_single(dev, slot->skb->data, slot->len, DMA_FROM_DEVICE);
++	slot->dma_addr = dma_map_single(dev, slot->buf + ENET_RX_BUF_DMA_OFFSET,
++					ENET_RX_BUF_DMA_SIZE, DMA_FROM_DEVICE);
+ 	err = dma_mapping_error(dev, slot->dma_addr);
+ 	if (err) {
+ 		dev_err(dev, "Failed to map DMA buffer: %d\n", err);
+-		kfree_skb(slot->skb);
+-		slot->skb = NULL;
++		skb_free_frag(slot->buf);
++		slot->buf = NULL;
+ 		return err;
+ 	}
+ 
+-	tmp = slot->len << DMA_CTL_LEN_DESC_BUFLENGTH_SHIFT;
++	tmp = ENET_RX_BUF_DMA_SIZE << DMA_CTL_LEN_DESC_BUFLENGTH_SHIFT;
+ 	tmp |= DMA_CTL_STATUS_OWN;
+ 	if (idx == enet->rx_ring.length - 1)
+ 		tmp |= DMA_CTL_STATUS_WRAP;
+@@ -314,11 +324,11 @@ static void bcm4908_enet_dma_uninit(stru
+ 
+ 	for (i = rx_ring->length - 1; i >= 0; i--) {
+ 		slot = &rx_ring->slots[i];
+-		if (!slot->skb)
++		if (!slot->buf)
+ 			continue;
+ 		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_FROM_DEVICE);
+-		kfree_skb(slot->skb);
+-		slot->skb = NULL;
++		skb_free_frag(slot->buf);
++		slot->buf = NULL;
+ 	}
+ }
+ 
+@@ -574,6 +584,7 @@ static int bcm4908_enet_poll_rx(struct n
+ 	while (handled < weight) {
+ 		struct bcm4908_enet_dma_ring_bd *buf_desc;
+ 		struct bcm4908_enet_dma_ring_slot slot;
++		struct sk_buff *skb;
+ 		u32 ctl;
+ 		int len;
+ 		int err;
+@@ -597,16 +608,24 @@ static int bcm4908_enet_poll_rx(struct n
+ 
+ 		if (len < ETH_ZLEN ||
+ 		    (ctl & (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) != (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) {
+-			kfree_skb(slot.skb);
++			skb_free_frag(slot.buf);
+ 			enet->netdev->stats.rx_dropped++;
+ 			break;
+ 		}
+ 
+-		dma_unmap_single(dev, slot.dma_addr, slot.len, DMA_FROM_DEVICE);
++		dma_unmap_single(dev, slot.dma_addr, ENET_RX_BUF_DMA_SIZE, DMA_FROM_DEVICE);
++
++		skb = build_skb(slot.buf, ENET_RX_SKB_BUF_ALLOC_SIZE);
++		if (unlikely(!skb)) {
++			skb_free_frag(slot.buf);
++			enet->netdev->stats.rx_dropped++;
++			break;
++		}
++		skb_reserve(skb, ENET_RX_BUF_DMA_OFFSET);
++		skb_put(skb, len - ETH_FCS_LEN);
++		skb->protocol = eth_type_trans(skb, enet->netdev);
+ 
+-		skb_put(slot.skb, len - ETH_FCS_LEN);
+-		slot.skb->protocol = eth_type_trans(slot.skb, enet->netdev);
+-		netif_receive_skb(slot.skb);
++		netif_receive_skb(skb);
+ 
+ 		enet->netdev->stats.rx_packets++;
+ 		enet->netdev->stats.rx_bytes += len;
diff --git a/target/linux/bcm4908/patches-5.10/170-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch b/target/linux/bcm4908/patches-5.10/170-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch
new file mode 100644
index 0000000000..cd01c9177c
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.10/170-net-broadcom-bcm4908_enet-report-queued-and-transmit.patch
@@ -0,0 +1,42 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 27 Oct 2022 22:18:05 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: report queued and transmitted
+ bytes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows BQL to operate avoiding buffer bloat and reducing latency.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -504,6 +504,7 @@ static int bcm4908_enet_stop(struct net_
+ 	netif_carrier_off(netdev);
+ 	napi_disable(&rx_ring->napi);
+ 	napi_disable(&tx_ring->napi);
++	netdev_reset_queue(netdev);
+ 
+ 	bcm4908_enet_dma_rx_ring_disable(enet, &enet->rx_ring);
+ 	bcm4908_enet_dma_tx_ring_disable(enet, &enet->tx_ring);
+@@ -563,6 +564,8 @@ static int bcm4908_enet_start_xmit(struc
+ 	if (ring->write_idx + 1 == ring->length - 1)
+ 		tmp |= DMA_CTL_STATUS_WRAP;
+ 
++	netdev_sent_queue(enet->netdev, skb->len);
++
+ 	buf_desc->addr = cpu_to_le32((uint32_t)slot->dma_addr);
+ 	buf_desc->ctl = cpu_to_le32(tmp);
+ 
+@@ -670,6 +673,7 @@ static int bcm4908_enet_poll_tx(struct n
+ 			tx_ring->read_idx = 0;
+ 	}
+ 
++	netdev_completed_queue(enet->netdev, handled, bytes);
+ 	enet->netdev->stats.tx_packets += handled;
+ 	enet->netdev->stats.tx_bytes += bytes;
+ 
diff --git a/target/linux/bcm53xx/patches-5.10/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-5.10/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
index d6c206a5cd..bce4ea6740 100644
--- a/target/linux/bcm53xx/patches-5.10/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-5.10/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -127,10 +127,10 @@ it on BCM4708 family.
  /*
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1888,6 +1888,7 @@ struct xhci_hcd {
- #define XHCI_SG_TRB_CACHE_SIZE_QUIRK	BIT_ULL(39)
+@@ -1889,6 +1889,7 @@ struct xhci_hcd {
  #define XHCI_NO_SOFT_RETRY	BIT_ULL(40)
  #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
 +#define XHCI_FAKE_DOORBELL	BIT_ULL(44)
  
  	unsigned int		num_active_eps;
diff --git a/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
index 285dd8df84..239c140c9b 100644
--- a/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-5.15/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -127,10 +127,10 @@ it on BCM4708 family.
  /*
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1903,6 +1903,7 @@ struct xhci_hcd {
- #define XHCI_NO_SOFT_RETRY	BIT_ULL(40)
+@@ -1904,6 +1904,7 @@ struct xhci_hcd {
  #define XHCI_BROKEN_D3COLD	BIT_ULL(41)
  #define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
+ #define XHCI_SUSPEND_RESUME_CLKS	BIT_ULL(43)
 +#define XHCI_FAKE_DOORBELL	BIT_ULL(44)
  
  	unsigned int		num_active_eps;
diff --git a/target/linux/generic/backport-5.10/005-v5.17-02-Kbuild-move-to-std-gnu11.patch b/target/linux/generic/backport-5.10/005-v5.17-02-Kbuild-move-to-std-gnu11.patch
index c56cecfb71..af95766f7c 100644
--- a/target/linux/generic/backport-5.10/005-v5.17-02-Kbuild-move-to-std-gnu11.patch
+++ b/target/linux/generic/backport-5.10/005-v5.17-02-Kbuild-move-to-std-gnu11.patch
@@ -49,7 +49,7 @@ Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -498,7 +498,7 @@ KBUILD_CFLAGS   := -Wall -Wundef -Werror
+@@ -500,7 +500,7 @@ KBUILD_CFLAGS   := -Wall -Wundef -Werror
  		   -fno-strict-aliasing -fno-common -fshort-wchar -fno-PIE \
  		   -Werror=implicit-function-declaration -Werror=implicit-int \
  		   -Werror=return-type -Wno-format-security \
diff --git a/target/linux/generic/backport-5.10/011-kbuild-export-SUBARCH.patch b/target/linux/generic/backport-5.10/011-kbuild-export-SUBARCH.patch
index f7e2d207cc..8f67ebe020 100644
--- a/target/linux/generic/backport-5.10/011-kbuild-export-SUBARCH.patch
+++ b/target/linux/generic/backport-5.10/011-kbuild-export-SUBARCH.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -508,7 +508,7 @@ KBUILD_LDFLAGS_MODULE :=
+@@ -510,7 +510,7 @@ KBUILD_LDFLAGS_MODULE :=
  KBUILD_LDFLAGS :=
  CLANG_FLAGS :=
  
diff --git a/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch b/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch
index b3eb58831c..67c762d28c 100644
--- a/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch
+++ b/target/linux/generic/backport-5.10/782-v5.11-net-usb-r8153_ecm-support-ECM-mode-for-RTL8153.patch
@@ -89,7 +89,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  struct tally_counter {
  	__le64	tx_packets;
  	__le64	rx_packets;
-@@ -6602,7 +6579,7 @@ static int rtl_fw_init(struct r8152 *tp)
+@@ -6604,7 +6581,7 @@ static int rtl_fw_init(struct r8152 *tp)
  	return 0;
  }
  
@@ -98,7 +98,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  {
  	struct usb_device *udev = interface_to_usbdev(intf);
  	u32 ocp_data = 0;
-@@ -6660,12 +6637,13 @@ static u8 rtl_get_version(struct usb_int
+@@ -6662,12 +6639,13 @@ static u8 rtl_get_version(struct usb_int
  
  	return version;
  }
diff --git a/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch b/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch
index eeb85d7951..1f43340c68 100644
--- a/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch
+++ b/target/linux/generic/backport-5.10/783-v5.12-net-usb-r8152-use-new-tasklet-API.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -2393,11 +2393,9 @@ static void tx_bottom(struct r8152 *tp)
+@@ -2395,11 +2395,9 @@ static void tx_bottom(struct r8152 *tp)
  	} while (res == 0);
  }
  
@@ -30,7 +30,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	if (test_bit(RTL8152_UNPLUG, &tp->flags))
  		return;
-@@ -6695,7 +6693,7 @@ static int rtl8152_probe(struct usb_inte
+@@ -6697,7 +6695,7 @@ static int rtl8152_probe(struct usb_inte
  	mutex_init(&tp->control);
  	INIT_DELAYED_WORK(&tp->schedule, rtl_work_func_t);
  	INIT_DELAYED_WORK(&tp->hw_phy_work, rtl_hw_phy_work_func_t);
diff --git a/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch b/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch
index faaa8275c5..759a09ae09 100644
--- a/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch
+++ b/target/linux/generic/backport-5.10/784-v5.12-r8152-replace-several-functions-about-phy-patch-requ.patch
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -3443,59 +3443,76 @@ static void rtl_clear_bp(struct r8152 *t
+@@ -3445,59 +3445,76 @@ static void rtl_clear_bp(struct r8152 *t
  	ocp_write_word(tp, type, PLA_BP_BA, 0);
  }
  
@@ -127,7 +127,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_OCP_GPHY_BASE, tp->ocp_base);
  
-@@ -3980,7 +3997,7 @@ static void rtl8152_fw_mac_apply(struct
+@@ -3982,7 +3999,7 @@ static void rtl8152_fw_mac_apply(struct
  	dev_dbg(&tp->intf->dev, "successfully applied %s\n", mac->info);
  }
  
@@ -136,7 +136,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  {
  	struct rtl_fw *rtl_fw = &tp->rtl_fw;
  	const struct firmware *fw;
-@@ -4011,12 +4028,11 @@ static void rtl8152_apply_firmware(struc
+@@ -4013,12 +4030,11 @@ static void rtl8152_apply_firmware(struc
  		case RTL_FW_PHY_START:
  			key = (struct fw_phy_patch_key *)block;
  			key_addr = __le16_to_cpu(key->key_reg);
@@ -151,7 +151,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			break;
  		case RTL_FW_PHY_NC:
  			rtl8152_fw_phy_nc_apply(tp, (struct fw_phy_nc *)block);
-@@ -4221,7 +4237,7 @@ static void rtl8152_disable(struct r8152
+@@ -4223,7 +4239,7 @@ static void rtl8152_disable(struct r8152
  
  static void r8152b_hw_phy_cfg(struct r8152 *tp)
  {
@@ -160,7 +160,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	rtl_eee_enable(tp, tp->eee_en);
  	r8152_aldps_en(tp, true);
  	r8152b_enable_fc(tp);
-@@ -4503,7 +4519,7 @@ static void r8153_hw_phy_cfg(struct r815
+@@ -4505,7 +4521,7 @@ static void r8153_hw_phy_cfg(struct r815
  	/* disable EEE before updating the PHY parameters */
  	rtl_eee_enable(tp, false);
  
@@ -169,7 +169,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	if (tp->version == RTL_VER_03) {
  		data = ocp_reg_read(tp, OCP_EEE_CFG);
-@@ -4577,7 +4593,7 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4579,7 +4595,7 @@ static void r8153b_hw_phy_cfg(struct r81
  	/* disable EEE before updating the PHY parameters */
  	rtl_eee_enable(tp, false);
  
@@ -178,7 +178,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	r8153b_green_en(tp, test_bit(GREEN_ETHERNET, &tp->flags));
  
-@@ -4618,7 +4634,7 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4620,7 +4636,7 @@ static void r8153b_hw_phy_cfg(struct r81
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR, ocp_data);
  
  	/* Advnace EEE */
@@ -187,7 +187,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		data = ocp_reg_read(tp, OCP_POWER_CFG);
  		data |= EEE_CLKDIV_EN;
  		ocp_reg_write(tp, OCP_POWER_CFG, data);
-@@ -4635,7 +4651,7 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4637,7 +4653,7 @@ static void r8153b_hw_phy_cfg(struct r81
  		ocp_reg_write(tp, OCP_SYSCLK_CFG, clk_div_expo(5));
  		tp->ups_info._250m_ckdiv = true;
  
diff --git a/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch b/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch
index 9d12cb9761..33969c7a54 100644
--- a/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch
+++ b/target/linux/generic/backport-5.10/785-v5.12-r8152-adjust-the-flow-of-power-cut-for-RTL8153B.patch
@@ -31,7 +31,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static int rtl8152_set_mac_address(struct net_device *netdev, void *p)
  {
  	struct r8152 *tp = netdev_priv(netdev);
-@@ -3182,8 +3186,6 @@ static void r8153b_ups_en(struct r8152 *
+@@ -3184,8 +3188,6 @@ static void r8153b_ups_en(struct r8152 *
  		ocp_data |= BIT(0);
  		ocp_write_byte(tp, MCU_TYPE_USB, 0xcfff, ocp_data);
  	} else {
@@ -40,7 +40,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		ocp_data &= ~(UPS_EN | USP_PREWAKE);
  		ocp_write_byte(tp, MCU_TYPE_USB, USB_POWER_CUT, ocp_data);
  
-@@ -3191,31 +3193,20 @@ static void r8153b_ups_en(struct r8152 *
+@@ -3193,31 +3195,20 @@ static void r8153b_ups_en(struct r8152 *
  		ocp_data &= ~BIT(0);
  		ocp_write_byte(tp, MCU_TYPE_USB, 0xcfff, ocp_data);
  
@@ -83,7 +83,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		}
  	}
  }
-@@ -4587,13 +4578,37 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4589,13 +4580,37 @@ static void r8153b_hw_phy_cfg(struct r81
  	u32 ocp_data;
  	u16 data;
  
@@ -122,7 +122,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	r8153b_green_en(tp, test_bit(GREEN_ETHERNET, &tp->flags));
  
-@@ -5522,9 +5537,6 @@ static void r8153b_init(struct r8152 *tp
+@@ -5524,9 +5539,6 @@ static void r8153b_init(struct r8152 *tp
  	/* MSC timer = 0xfff * 8ms = 32760 ms */
  	ocp_write_word(tp, MCU_TYPE_USB, USB_MSC_TIMER, 0x0fff);
  
diff --git a/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch b/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch
index f97deaa7d2..6815fabe10 100644
--- a/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch
+++ b/target/linux/generic/backport-5.10/786-v5.12-r8152-enable-U1-U2-for-USB_SPEED_SUPER.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -3335,7 +3335,7 @@ static void rtl8153b_runtime_enable(stru
+@@ -3337,7 +3337,7 @@ static void rtl8153b_runtime_enable(stru
  		r8153b_ups_en(tp, false);
  		r8153_queue_wake(tp, false);
  		rtl_runtime_suspend_enable(tp, false);
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			r8153b_u1u2en(tp, true);
  	}
  }
-@@ -5028,7 +5028,7 @@ static void rtl8153b_up(struct r8152 *tp
+@@ -5030,7 +5030,7 @@ static void rtl8153b_up(struct r8152 *tp
  
  	r8153_aldps_en(tp, true);
  
@@ -34,7 +34,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		r8153b_u1u2en(tp, true);
  }
  
-@@ -5550,8 +5550,9 @@ static void r8153b_init(struct r8152 *tp
+@@ -5552,8 +5552,9 @@ static void r8153b_init(struct r8152 *tp
  	ocp_data |= POLL_LINK_CHG;
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS, ocp_data);
  
diff --git a/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch b/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch
index 4f754bc69e..f13626faf0 100644
--- a/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch
+++ b/target/linux/generic/backport-5.10/787-v5.12-r8152-check-if-the-pointer-of-the-function-exists.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -5735,6 +5735,9 @@ static int rtl8152_runtime_suspend(struc
+@@ -5737,6 +5737,9 @@ static int rtl8152_runtime_suspend(struc
  	struct net_device *netdev = tp->netdev;
  	int ret = 0;
  
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	set_bit(SELECTIVE_SUSPEND, &tp->flags);
  	smp_mb__after_atomic();
  
-@@ -6134,6 +6137,11 @@ rtl_ethtool_get_eee(struct net_device *n
+@@ -6136,6 +6139,11 @@ rtl_ethtool_get_eee(struct net_device *n
  	struct r8152 *tp = netdev_priv(net);
  	int ret;
  
@@ -37,7 +37,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	ret = usb_autopm_get_interface(tp->intf);
  	if (ret < 0)
  		goto out;
-@@ -6156,6 +6164,11 @@ rtl_ethtool_set_eee(struct net_device *n
+@@ -6158,6 +6166,11 @@ rtl_ethtool_set_eee(struct net_device *n
  	struct r8152 *tp = netdev_priv(net);
  	int ret;
  
diff --git a/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch b/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch
index 9136611e0f..24c606b5f5 100644
--- a/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch
+++ b/target/linux/generic/backport-5.10/788-v5.12-r8152-replace-netif_err-with-dev_err.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -6571,7 +6571,7 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -6573,7 +6573,7 @@ static int rtl_ops_init(struct r8152 *tp
  
  	default:
  		ret = -ENODEV;
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		break;
  	}
  
-@@ -6828,7 +6828,7 @@ static int rtl8152_probe(struct usb_inte
+@@ -6830,7 +6830,7 @@ static int rtl8152_probe(struct usb_inte
  
  	ret = register_netdev(netdev);
  	if (ret != 0) {
diff --git a/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch b/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch
index 0467e06a3c..c5e7ff9624 100644
--- a/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch
+++ b/target/linux/generic/backport-5.10/789-v5.12-r8152-spilt-rtl_set_eee_plus-and-r8153b_green_en.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -2632,21 +2632,24 @@ static inline u8 rtl8152_get_speed(struc
+@@ -2634,21 +2634,24 @@ static inline u8 rtl8152_get_speed(struc
  	return ocp_read_byte(tp, MCU_TYPE_PLA, PLA_PHYSTATUS);
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  }
  
  static void rxdy_gated_en(struct r8152 *tp, bool enable)
-@@ -3127,10 +3130,22 @@ static void r8153b_ups_flags(struct r815
+@@ -3129,10 +3132,22 @@ static void r8153b_ups_flags(struct r815
  	ocp_write_dword(tp, MCU_TYPE_USB, USB_UPS_FLAGS, ups_flags);
  }
  
@@ -74,7 +74,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	if (enable) {
  		sram_write(tp, 0x8045, 0);	/* 10M abiq&ldvbias */
  		sram_write(tp, 0x804d, 0x1222);	/* 100M short abiq&ldvbias */
-@@ -3141,11 +3156,7 @@ static void r8153b_green_en(struct r8152
+@@ -3143,11 +3158,7 @@ static void r8153b_green_en(struct r8152
  		sram_write(tp, 0x805d, 0x2444);	/* 1000M short abiq&ldvbias */
  	}
  
diff --git a/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch b/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch
index 15ba2bf29c..9ed92328c3 100644
--- a/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch
+++ b/target/linux/generic/backport-5.10/790-v5.13-r8152-set-inter-fram-gap-time-depending-on-speed.patch
@@ -34,7 +34,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  /* PLA_MTPS */
  #define MTPS_JUMBO		(12 * 1024 / 64)
-@@ -2747,6 +2750,29 @@ static int rtl_stop_rx(struct r8152 *tp)
+@@ -2749,6 +2752,29 @@ static int rtl_stop_rx(struct r8152 *tp)
  	return 0;
  }
  
@@ -64,7 +64,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static inline void r8153b_rx_agg_chg_indicate(struct r8152 *tp)
  {
  	ocp_write_byte(tp, MCU_TYPE_USB, USB_UPT_RXDMA_OWN,
-@@ -2850,6 +2876,8 @@ static int rtl8153_enable(struct r8152 *
+@@ -2852,6 +2878,8 @@ static int rtl8153_enable(struct r8152 *
  	r8153_set_rx_early_timeout(tp);
  	r8153_set_rx_early_size(tp);
  
diff --git a/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch b/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch
index f07c160c71..c61c4bb98a 100644
--- a/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch
+++ b/target/linux/generic/backport-5.10/791-v5.13-r8152-adjust-rtl8152_check_firmware-function.patch
@@ -30,7 +30,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  /**
   * struct fw_mac - a firmware block used by RTL_FW_PLA and RTL_FW_USB.
   *	The layout of the firmware block is:
-@@ -3800,10 +3808,7 @@ static long rtl8152_check_firmware(struc
+@@ -3802,10 +3810,7 @@ static long rtl8152_check_firmware(struc
  {
  	const struct firmware *fw = rtl_fw->fw;
  	struct fw_header *fw_hdr = (struct fw_header *)fw->data;
@@ -42,7 +42,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	long ret = -EFAULT;
  	int i;
  
-@@ -3832,50 +3837,52 @@ static long rtl8152_check_firmware(struc
+@@ -3834,50 +3839,52 @@ static long rtl8152_check_firmware(struc
  				goto fail;
  			goto fw_end;
  		case RTL_FW_PLA:
@@ -106,7 +106,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				dev_err(&tp->intf->dev,
  					"Check PHY_STOP fail\n");
  				goto fail;
-@@ -3886,28 +3893,28 @@ static long rtl8152_check_firmware(struc
+@@ -3888,28 +3895,28 @@ static long rtl8152_check_firmware(struc
  					"Invalid length for PHY_STOP\n");
  				goto fail;
  			}
@@ -141,7 +141,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  			break;
  		default:
-@@ -3921,7 +3928,7 @@ static long rtl8152_check_firmware(struc
+@@ -3923,7 +3930,7 @@ static long rtl8152_check_firmware(struc
  	}
  
  fw_end:
diff --git a/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch b/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch
index 63da9adfd3..cd7a514b71 100644
--- a/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch
+++ b/target/linux/generic/backport-5.10/792-v5.13-r8152-add-help-function-to-change-mtu.patch
@@ -57,7 +57,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  static
  int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
-@@ -2632,10 +2630,7 @@ static void rtl8152_nic_reset(struct r81
+@@ -2634,10 +2632,7 @@ static void rtl8152_nic_reset(struct r81
  
  static void set_tx_qlen(struct r8152 *tp)
  {
@@ -69,7 +69,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static inline u8 rtl8152_get_speed(struct r8152 *tp)
-@@ -4724,6 +4719,12 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4726,6 +4721,12 @@ static void r8153b_hw_phy_cfg(struct r81
  	set_bit(PHY_RESET, &tp->flags);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_first_init(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -4756,9 +4757,7 @@ static void r8153_first_init(struct r815
+@@ -4758,9 +4759,7 @@ static void r8153_first_init(struct r815
  
  	rtl_rx_vlan_en(tp, tp->netdev->features & NETIF_F_HW_VLAN_CTAG_RX);
  
@@ -93,7 +93,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0);
  	ocp_data |= TCR0_AUTO_FIFO;
-@@ -4793,8 +4792,7 @@ static void r8153_enter_oob(struct r8152
+@@ -4795,8 +4794,7 @@ static void r8153_enter_oob(struct r8152
  
  	wait_oob_link_list_ready(tp);
  
@@ -103,7 +103,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	switch (tp->version) {
  	case RTL_VER_03:
-@@ -6495,12 +6493,21 @@ static int rtl8152_change_mtu(struct net
+@@ -6497,12 +6495,21 @@ static int rtl8152_change_mtu(struct net
  	dev->mtu = new_mtu;
  
  	if (netif_running(dev)) {
@@ -130,7 +130,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	mutex_unlock(&tp->control);
-@@ -6589,6 +6596,7 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -6591,6 +6598,7 @@ static int rtl_ops_init(struct r8152 *tp
  		ops->in_nway		= rtl8153_in_nway;
  		ops->hw_phy_cfg		= r8153_hw_phy_cfg;
  		ops->autosuspend_en	= rtl8153_runtime_enable;
@@ -138,7 +138,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (tp->udev->speed < USB_SPEED_SUPER)
  			tp->rx_buf_sz	= 16 * 1024;
  		else
-@@ -6610,6 +6618,7 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -6612,6 +6620,7 @@ static int rtl_ops_init(struct r8152 *tp
  		ops->in_nway		= rtl8153_in_nway;
  		ops->hw_phy_cfg		= r8153b_hw_phy_cfg;
  		ops->autosuspend_en	= rtl8153b_runtime_enable;
@@ -146,7 +146,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		tp->rx_buf_sz		= 32 * 1024;
  		tp->eee_en		= true;
  		tp->eee_adv		= MDIO_EEE_1000T | MDIO_EEE_100TX;
-@@ -6830,7 +6839,7 @@ static int rtl8152_probe(struct usb_inte
+@@ -6832,7 +6841,7 @@ static int rtl8152_probe(struct usb_inte
  		netdev->max_mtu = ETH_DATA_LEN;
  		break;
  	default:
diff --git a/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch b/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch
index c53315a0df..1533229564 100644
--- a/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch
+++ b/target/linux/generic/backport-5.10/793-v5.13-r8152-support-new-chips.patch
@@ -379,7 +379,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  /* Maximum number of multicast addresses to filter (vs. Rx-all-multicast).
   * The RTL chips use a 64 element hash table based on the Ethernet CRC.
-@@ -2606,7 +2711,7 @@ static netdev_tx_t rtl8152_start_xmit(st
+@@ -2608,7 +2713,7 @@ static netdev_tx_t rtl8152_start_xmit(st
  
  static void r8152b_reset_packet_filter(struct r8152 *tp)
  {
@@ -388,7 +388,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_FMC);
  	ocp_data &= ~FMC_FCR_MCU_EN;
-@@ -2617,14 +2722,47 @@ static void r8152b_reset_packet_filter(s
+@@ -2619,14 +2724,47 @@ static void r8152b_reset_packet_filter(s
  
  static void rtl8152_nic_reset(struct r8152 *tp)
  {
@@ -442,7 +442,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  }
  
-@@ -2633,9 +2771,9 @@ static void set_tx_qlen(struct r8152 *tp
+@@ -2635,9 +2773,9 @@ static void set_tx_qlen(struct r8152 *tp
  	tp->tx_qlen = agg_buf_sz / (mtu_to_size(tp->netdev->mtu) + sizeof(struct tx_desc));
  }
  
@@ -454,7 +454,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static void rtl_eee_plus_en(struct r8152 *tp, bool enable)
-@@ -2795,6 +2933,7 @@ static int rtl_enable(struct r8152 *tp)
+@@ -2797,6 +2935,7 @@ static int rtl_enable(struct r8152 *tp)
  	switch (tp->version) {
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -462,7 +462,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		r8153b_rx_agg_chg_indicate(tp);
  		break;
  	default:
-@@ -2832,6 +2971,7 @@ static void r8153_set_rx_early_timeout(s
+@@ -2834,6 +2973,7 @@ static void r8153_set_rx_early_timeout(s
  
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -470,7 +470,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		/* The RTL8153B uses USB_RX_EXTRA_AGGR_TMR for rx timeout
  		 * primarily. For USB_RX_EARLY_TIMEOUT, we fix it to 128ns.
  		 */
-@@ -2841,6 +2981,18 @@ static void r8153_set_rx_early_timeout(s
+@@ -2843,6 +2983,18 @@ static void r8153_set_rx_early_timeout(s
  			       ocp_data);
  		break;
  
@@ -489,7 +489,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		break;
  	}
-@@ -2860,8 +3012,19 @@ static void r8153_set_rx_early_size(stru
+@@ -2862,8 +3014,19 @@ static void r8153_set_rx_early_size(stru
  		break;
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -509,7 +509,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		break;
  	default:
  		WARN_ON_ONCE(1);
-@@ -2871,6 +3034,8 @@ static void r8153_set_rx_early_size(stru
+@@ -2873,6 +3036,8 @@ static void r8153_set_rx_early_size(stru
  
  static int rtl8153_enable(struct r8152 *tp)
  {
@@ -518,7 +518,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (test_bit(RTL8152_UNPLUG, &tp->flags))
  		return -ENODEV;
  
-@@ -2881,15 +3046,18 @@ static int rtl8153_enable(struct r8152 *
+@@ -2883,15 +3048,18 @@ static int rtl8153_enable(struct r8152 *
  
  	rtl_set_ifg(tp, rtl8152_get_speed(tp));
  
@@ -540,7 +540,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	return rtl_enable(tp);
-@@ -2954,12 +3122,40 @@ static void rtl_rx_vlan_en(struct r8152
+@@ -2956,12 +3124,40 @@ static void rtl_rx_vlan_en(struct r8152
  {
  	u32 ocp_data;
  
@@ -587,7 +587,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static int rtl8152_set_features(struct net_device *dev,
-@@ -3052,6 +3248,40 @@ static void __rtl_set_wol(struct r8152 *
+@@ -3054,6 +3250,40 @@ static void __rtl_set_wol(struct r8152 *
  		device_set_wakeup_enable(&tp->udev->dev, false);
  }
  
@@ -628,7 +628,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_u1u2en(struct r8152 *tp, bool enable)
  {
  	u8 u1u2[8];
-@@ -3111,6 +3341,9 @@ static void r8153b_ups_flags(struct r815
+@@ -3113,6 +3343,9 @@ static void r8153b_ups_flags(struct r815
  	if (tp->ups_info.eee_cmod_lv)
  		ups_flags |= UPS_FLAGS_EEE_CMOD_LV_EN;
  
@@ -638,7 +638,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (tp->ups_info._10m_ckdiv)
  		ups_flags |= UPS_FLAGS_EN_10M_CKDIV;
  
-@@ -3161,6 +3394,88 @@ static void r8153b_ups_flags(struct r815
+@@ -3163,6 +3396,88 @@ static void r8153b_ups_flags(struct r815
  	ocp_write_dword(tp, MCU_TYPE_USB, USB_UPS_FLAGS, ups_flags);
  }
  
@@ -727,7 +727,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void rtl_green_en(struct r8152 *tp, bool enable)
  {
  	u16 data;
-@@ -3224,16 +3539,16 @@ static void r8153b_ups_en(struct r8152 *
+@@ -3226,16 +3541,16 @@ static void r8153b_ups_en(struct r8152 *
  		ocp_data |= UPS_EN | USP_PREWAKE | PHASE2_EN;
  		ocp_write_byte(tp, MCU_TYPE_USB, USB_POWER_CUT, ocp_data);
  
@@ -750,7 +750,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		if (ocp_read_word(tp, MCU_TYPE_USB, USB_MISC_0) & PCUT_STATUS) {
  			int i;
-@@ -3253,6 +3568,95 @@ static void r8153b_ups_en(struct r8152 *
+@@ -3255,6 +3570,95 @@ static void r8153b_ups_en(struct r8152 *
  	}
  }
  
@@ -846,7 +846,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_power_cut_en(struct r8152 *tp, bool enable)
  {
  	u32 ocp_data;
-@@ -3382,6 +3786,38 @@ static void rtl8153b_runtime_enable(stru
+@@ -3384,6 +3788,38 @@ static void rtl8153b_runtime_enable(stru
  	}
  }
  
@@ -885,7 +885,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_teredo_off(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -3402,14 +3838,19 @@ static void r8153_teredo_off(struct r815
+@@ -3404,14 +3840,19 @@ static void r8153_teredo_off(struct r815
  
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -908,7 +908,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_WDT6_CTRL, WDT6_SET_MODE);
-@@ -3444,6 +3885,12 @@ static void rtl_clear_bp(struct r8152 *t
+@@ -3446,6 +3887,12 @@ static void rtl_clear_bp(struct r8152 *t
  		break;
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -921,7 +921,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		if (type == MCU_TYPE_USB) {
  			ocp_write_word(tp, MCU_TYPE_USB, USB_BP2_EN, 0);
-@@ -3653,6 +4100,11 @@ static bool rtl8152_is_fw_mac_ok(struct
+@@ -3655,6 +4102,11 @@ static bool rtl8152_is_fw_mac_ok(struct
  		case RTL_VER_06:
  		case RTL_VER_08:
  		case RTL_VER_09:
@@ -933,7 +933,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			fw_reg = 0xf800;
  			bp_ba_addr = PLA_BP_BA;
  			bp_en_addr = PLA_BP_EN;
-@@ -3676,6 +4128,11 @@ static bool rtl8152_is_fw_mac_ok(struct
+@@ -3678,6 +4130,11 @@ static bool rtl8152_is_fw_mac_ok(struct
  			break;
  		case RTL_VER_08:
  		case RTL_VER_09:
@@ -945,7 +945,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			fw_reg = 0xe600;
  			bp_ba_addr = USB_BP_BA;
  			bp_en_addr = USB_BP2_EN;
-@@ -4215,6 +4672,22 @@ static void r8153_eee_en(struct r8152 *t
+@@ -4217,6 +4674,22 @@ static void r8153_eee_en(struct r8152 *t
  	tp->ups_info.eee = enable;
  }
  
@@ -968,7 +968,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void rtl_eee_enable(struct r8152 *tp, bool enable)
  {
  	switch (tp->version) {
-@@ -4236,6 +4709,7 @@ static void rtl_eee_enable(struct r8152
+@@ -4238,6 +4711,7 @@ static void rtl_eee_enable(struct r8152
  	case RTL_VER_06:
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -976,7 +976,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (enable) {
  			r8153_eee_en(tp, true);
  			ocp_reg_write(tp, OCP_EEE_ADV, tp->eee_adv);
-@@ -4244,6 +4718,19 @@ static void rtl_eee_enable(struct r8152
+@@ -4246,6 +4720,19 @@ static void rtl_eee_enable(struct r8152
  			ocp_reg_write(tp, OCP_EEE_ADV, 0);
  		}
  		break;
@@ -996,7 +996,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		break;
  	}
-@@ -4290,6 +4777,20 @@ static void wait_oob_link_list_ready(str
+@@ -4292,6 +4779,20 @@ static void wait_oob_link_list_ready(str
  	}
  }
  
@@ -1017,7 +1017,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8152b_exit_oob(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -4340,7 +4841,7 @@ static void r8152b_exit_oob(struct r8152
+@@ -4342,7 +4843,7 @@ static void r8152b_exit_oob(struct r8152
  	}
  
  	/* TX share fifo free credit full threshold */
@@ -1026,7 +1026,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ocp_write_byte(tp, MCU_TYPE_USB, USB_TX_AGG, TX_AGG_MAX_THRESHOLD);
  	ocp_write_dword(tp, MCU_TYPE_USB, USB_RX_BUF_TH, RX_THR_HIGH);
-@@ -4517,6 +5018,21 @@ static int r8153b_post_firmware_1(struct
+@@ -4519,6 +5020,21 @@ static int r8153b_post_firmware_1(struct
  	return 0;
  }
  
@@ -1048,7 +1048,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_aldps_en(struct r8152 *tp, bool enable)
  {
  	u16 data;
-@@ -4719,6 +5235,13 @@ static void r8153b_hw_phy_cfg(struct r81
+@@ -4721,6 +5237,13 @@ static void r8153b_hw_phy_cfg(struct r81
  	set_bit(PHY_RESET, &tp->flags);
  }
  
@@ -1062,7 +1062,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void rtl8153_change_mtu(struct r8152 *tp)
  {
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, mtu_to_size(tp->netdev->mtu));
-@@ -4806,6 +5329,7 @@ static void r8153_enter_oob(struct r8152
+@@ -4808,6 +5331,7 @@ static void r8153_enter_oob(struct r8152
  
  	case RTL_VER_08:
  	case RTL_VER_09:
@@ -1070,7 +1070,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		/* Clear teredo wake event. bit[15:8] is the teredo wakeup
  		 * type. Set it to zero. bits[7:0] are the W1C bits about
  		 * the events. Set them to all 1 to clear them.
-@@ -4842,6 +5366,96 @@ static void rtl8153_disable(struct r8152
+@@ -4844,6 +5368,96 @@ static void rtl8153_disable(struct r8152
  	r8153_aldps_en(tp, true);
  }
  
@@ -1167,7 +1167,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex,
  			     u32 advertising)
  {
-@@ -4890,58 +5504,73 @@ static int rtl8152_set_speed(struct r815
+@@ -4892,58 +5506,73 @@ static int rtl8152_set_speed(struct r815
  
  		tp->mii.force_media = 1;
  	} else {
@@ -1259,7 +1259,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		}
  
  		bmcr = BMCR_ANENABLE | BMCR_ANRESTART;
-@@ -5097,6 +5726,253 @@ static void rtl8153b_down(struct r8152 *
+@@ -5099,6 +5728,253 @@ static void rtl8153b_down(struct r8152 *
  	r8153_aldps_en(tp, true);
  }
  
@@ -1513,7 +1513,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static bool rtl8152_in_nway(struct r8152 *tp)
  {
  	u16 nway_state;
-@@ -5127,7 +6003,7 @@ static void set_carrier(struct r8152 *tp
+@@ -5129,7 +6005,7 @@ static void set_carrier(struct r8152 *tp
  {
  	struct net_device *netdev = tp->netdev;
  	struct napi_struct *napi = &tp->napi;
@@ -1522,7 +1522,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	speed = rtl8152_get_speed(tp);
  
-@@ -5140,7 +6016,7 @@ static void set_carrier(struct r8152 *tp
+@@ -5142,7 +6018,7 @@ static void set_carrier(struct r8152 *tp
  			rtl_start_rx(tp);
  			clear_bit(RTL8152_SET_RX_MODE, &tp->flags);
  			_rtl8152_set_rx_mode(netdev);
@@ -1531,7 +1531,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			netif_wake_queue(netdev);
  			netif_info(tp, link, netdev, "carrier on\n");
  		} else if (netif_queue_stopped(netdev) &&
-@@ -5502,14 +6378,9 @@ static void r8153_init(struct r8152 *tp)
+@@ -5504,14 +6380,9 @@ static void r8153_init(struct r8152 *tp)
  
  	ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
  
@@ -1547,7 +1547,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	r8153_u1u2en(tp, true);
  	usb_enable_lpm(tp->udev);
  
-@@ -5600,9 +6471,7 @@ static void r8153b_init(struct r8152 *tp
+@@ -5602,9 +6473,7 @@ static void r8153b_init(struct r8152 *tp
  	usb_enable_lpm(tp->udev);
  
  	/* MAC clock speed down */
@@ -1558,7 +1558,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
  	ocp_data &= ~PLA_MCU_SPDWN_EN;
-@@ -5629,6 +6498,1069 @@ static void r8153b_init(struct r8152 *tp
+@@ -5631,6 +6500,1069 @@ static void r8153b_init(struct r8152 *tp
  	tp->coalesce = 15000;	/* 15 us */
  }
  
@@ -2628,7 +2628,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static int rtl8152_pre_reset(struct usb_interface *intf)
  {
  	struct r8152 *tp = usb_get_intfdata(intf);
-@@ -5992,6 +7924,22 @@ int rtl8152_get_link_ksettings(struct ne
+@@ -5994,6 +7926,22 @@ int rtl8152_get_link_ksettings(struct ne
  
  	mii_ethtool_get_link_ksettings(&tp->mii, cmd);
  
@@ -2651,7 +2651,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	mutex_unlock(&tp->control);
  
  	usb_autopm_put_interface(tp->intf);
-@@ -6035,6 +7983,10 @@ static int rtl8152_set_link_ksettings(st
+@@ -6037,6 +7985,10 @@ static int rtl8152_set_link_ksettings(st
  		     cmd->link_modes.advertising))
  		advertising |= RTL_ADVERTISED_1000_FULL;
  
@@ -2662,7 +2662,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	mutex_lock(&tp->control);
  
  	ret = rtl8152_set_speed(tp, cmd->base.autoneg, cmd->base.speed,
-@@ -6624,6 +8576,67 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -6626,6 +8578,67 @@ static int rtl_ops_init(struct r8152 *tp
  		tp->eee_adv		= MDIO_EEE_1000T | MDIO_EEE_100TX;
  		break;
  
@@ -2730,7 +2730,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		ret = -ENODEV;
  		dev_err(&tp->intf->dev, "Unknown Device\n");
-@@ -6637,11 +8650,13 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -6639,11 +8652,13 @@ static int rtl_ops_init(struct r8152 *tp
  #define FIRMWARE_8153A_3	"rtl_nic/rtl8153a-3.fw"
  #define FIRMWARE_8153A_4	"rtl_nic/rtl8153a-4.fw"
  #define FIRMWARE_8153B_2	"rtl_nic/rtl8153b-2.fw"
@@ -2744,7 +2744,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  static int rtl_fw_init(struct r8152 *tp)
  {
-@@ -6667,6 +8682,11 @@ static int rtl_fw_init(struct r8152 *tp)
+@@ -6669,6 +8684,11 @@ static int rtl_fw_init(struct r8152 *tp)
  		rtl_fw->pre_fw		= r8153b_pre_firmware_1;
  		rtl_fw->post_fw		= r8153b_post_firmware_1;
  		break;
@@ -2756,7 +2756,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		break;
  	}
-@@ -6722,6 +8742,27 @@ u8 rtl8152_get_version(struct usb_interf
+@@ -6724,6 +8744,27 @@ u8 rtl8152_get_version(struct usb_interf
  	case 0x6010:
  		version = RTL_VER_09;
  		break;
@@ -2784,7 +2784,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	default:
  		version = RTL_VER_UNKNOWN;
  		dev_info(&intf->dev, "Unknown version 0x%04x\n", ocp_data);
-@@ -6834,12 +8875,29 @@ static int rtl8152_probe(struct usb_inte
+@@ -6836,12 +8877,29 @@ static int rtl8152_probe(struct usb_inte
  	/* MTU range: 68 - 1500 or 9194 */
  	netdev->min_mtu = ETH_MIN_MTU;
  	switch (tp->version) {
@@ -2817,7 +2817,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		break;
  	}
  
-@@ -6855,7 +8913,13 @@ static int rtl8152_probe(struct usb_inte
+@@ -6857,7 +8915,13 @@ static int rtl8152_probe(struct usb_inte
  	tp->advertising = RTL_ADVERTISED_10_HALF | RTL_ADVERTISED_10_FULL |
  			  RTL_ADVERTISED_100_HALF | RTL_ADVERTISED_100_FULL;
  	if (tp->mii.supports_gmii) {
@@ -2832,7 +2832,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		tp->advertising |= RTL_ADVERTISED_1000_FULL;
  	}
  	tp->duplex = DUPLEX_FULL;
-@@ -6879,7 +8943,11 @@ static int rtl8152_probe(struct usb_inte
+@@ -6881,7 +8945,11 @@ static int rtl8152_probe(struct usb_inte
  	set_ethernet_addr(tp);
  
  	usb_set_intfdata(intf, tp);
@@ -2845,7 +2845,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ret = register_netdev(netdev);
  	if (ret != 0) {
-@@ -6915,7 +8983,8 @@ static void rtl8152_disconnect(struct us
+@@ -6917,7 +8985,8 @@ static void rtl8152_disconnect(struct us
  		unregister_netdev(tp->netdev);
  		tasklet_kill(&tp->tx_tl);
  		cancel_delayed_work_sync(&tp->hw_phy_work);
@@ -2855,7 +2855,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		rtl8152_release_firmware(tp);
  		free_netdev(tp->netdev);
  	}
-@@ -6935,13 +9004,28 @@ static void rtl8152_disconnect(struct us
+@@ -6937,13 +9006,28 @@ static void rtl8152_disconnect(struct us
  	.idProduct = (prod), \
  	.bInterfaceClass = USB_CLASS_COMM, \
  	.bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, \
diff --git a/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch b/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch
index 351f83e2e4..40dae54f8c 100644
--- a/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch
+++ b/target/linux/generic/backport-5.10/794-v5.13-r8152-support-PHY-firmware-for-RTL8156-series.patch
@@ -92,7 +92,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  enum rtl_version {
-@@ -3999,6 +4060,162 @@ static int rtl_post_ram_code(struct r815
+@@ -4001,6 +4062,162 @@ static int rtl_post_ram_code(struct r815
  	return 0;
  }
  
@@ -255,7 +255,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static bool rtl8152_is_fw_phy_nc_ok(struct r8152 *tp, struct fw_phy_nc *phy)
  {
  	u32 length;
-@@ -4319,6 +4536,10 @@ static long rtl8152_check_firmware(struc
+@@ -4321,6 +4538,10 @@ static long rtl8152_check_firmware(struc
  		case RTL_FW_PHY_START:
  			if (test_bit(FW_FLAGS_START, &fw_flags) ||
  			    test_bit(FW_FLAGS_NC, &fw_flags) ||
@@ -266,7 +266,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			    test_bit(FW_FLAGS_STOP, &fw_flags)) {
  				dev_err(&tp->intf->dev,
  					"check PHY_START fail\n");
-@@ -4367,7 +4588,153 @@ static long rtl8152_check_firmware(struc
+@@ -4369,7 +4590,153 @@ static long rtl8152_check_firmware(struc
  				goto fail;
  			}
  			__set_bit(FW_FLAGS_NC, &fw_flags);
@@ -420,7 +420,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			break;
  		default:
  			dev_warn(&tp->intf->dev, "Unknown type %u is found\n",
-@@ -4390,6 +4757,143 @@ fail:
+@@ -4392,6 +4759,143 @@ fail:
  	return ret;
  }
  
@@ -564,7 +564,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void rtl8152_fw_phy_nc_apply(struct r8152 *tp, struct fw_phy_nc *phy)
  {
  	u16 mode_reg, bp_index;
-@@ -4443,6 +4947,12 @@ static void rtl8152_fw_mac_apply(struct
+@@ -4445,6 +4949,12 @@ static void rtl8152_fw_mac_apply(struct
  		return;
  	}
  
@@ -577,7 +577,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	rtl_clear_bp(tp, type);
  
  	/* Enable backup/restore of MACDBG. This is required after clearing PLA
-@@ -4478,7 +4988,6 @@ static void rtl8152_fw_mac_apply(struct
+@@ -4480,7 +4990,6 @@ static void rtl8152_fw_mac_apply(struct
  		ocp_write_word(tp, type, bp_en_addr,
  			       __le16_to_cpu(mac->bp_en_value));
  
@@ -585,7 +585,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	if (fw_ver_reg)
  		ocp_write_byte(tp, MCU_TYPE_USB, fw_ver_reg,
  			       mac->fw_ver_data);
-@@ -4493,7 +5002,7 @@ static void rtl8152_apply_firmware(struc
+@@ -4495,7 +5004,7 @@ static void rtl8152_apply_firmware(struc
  	struct fw_header *fw_hdr;
  	struct fw_phy_patch_key *key;
  	u16 key_addr = 0;
@@ -594,7 +594,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (IS_ERR_OR_NULL(rtl_fw->fw))
  		return;
-@@ -4515,17 +5024,40 @@ static void rtl8152_apply_firmware(struc
+@@ -4517,17 +5026,40 @@ static void rtl8152_apply_firmware(struc
  			rtl8152_fw_mac_apply(tp, (struct fw_mac *)block);
  			break;
  		case RTL_FW_PHY_START:
@@ -635,7 +635,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		default:
  			break;
  		}
-@@ -5033,6 +5565,21 @@ static int r8153c_post_firmware_1(struct
+@@ -5035,6 +5567,21 @@ static int r8153c_post_firmware_1(struct
  	return 0;
  }
  
@@ -657,7 +657,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8153_aldps_en(struct r8152 *tp, bool enable)
  {
  	u16 data;
-@@ -8651,12 +9198,16 @@ static int rtl_ops_init(struct r8152 *tp
+@@ -8653,12 +9200,16 @@ static int rtl_ops_init(struct r8152 *tp
  #define FIRMWARE_8153A_4	"rtl_nic/rtl8153a-4.fw"
  #define FIRMWARE_8153B_2	"rtl_nic/rtl8153b-2.fw"
  #define FIRMWARE_8153C_1	"rtl_nic/rtl8153c-1.fw"
@@ -674,7 +674,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  static int rtl_fw_init(struct r8152 *tp)
  {
-@@ -8682,6 +9233,14 @@ static int rtl_fw_init(struct r8152 *tp)
+@@ -8684,6 +9235,14 @@ static int rtl_fw_init(struct r8152 *tp)
  		rtl_fw->pre_fw		= r8153b_pre_firmware_1;
  		rtl_fw->post_fw		= r8153b_post_firmware_1;
  		break;
diff --git a/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch b/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch
index f5abb5d3c9..751ff3d30c 100644
--- a/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch
+++ b/target/linux/generic/backport-5.10/795-v5.13-r8152-search-the-configuration-of-vendor-mode.patch
@@ -25,7 +25,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  /* Information for net */
  #define NET_VERSION		"11"
-@@ -8108,6 +8108,39 @@ static void r8156b_init(struct r8152 *tp
+@@ -8110,6 +8110,39 @@ static void r8156b_init(struct r8152 *tp
  	tp->coalesce = 15000;	/* 15 us */
  }
  
@@ -65,7 +65,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static int rtl8152_pre_reset(struct usb_interface *intf)
  {
  	struct r8152 *tp = usb_get_intfdata(intf);
-@@ -9346,10 +9379,8 @@ static int rtl8152_probe(struct usb_inte
+@@ -9348,10 +9381,8 @@ static int rtl8152_probe(struct usb_inte
  	if (version == RTL_VER_UNKNOWN)
  		return -ENODEV;
  
diff --git a/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch b/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch
index 48bcaf3e3e..2a4207c3b5 100644
--- a/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch
+++ b/target/linux/generic/backport-5.15/020-v6.1-01-mm-x86-arm64-add-arch_has_hw_pte_young.patch
@@ -72,7 +72,7 @@ Change-Id: Ib49b44fb56df3333a2ff1fcc496fb1980b976e7a
  
 --- a/arch/arm64/kernel/cpufeature.c
 +++ b/arch/arm64/kernel/cpufeature.c
-@@ -2187,6 +2187,16 @@ static const struct arm64_cpu_capabiliti
+@@ -2197,6 +2197,16 @@ static const struct arm64_cpu_capabiliti
  		.matches = has_hw_dbm,
  		.cpu_enable = cpu_enable_hw_dbm,
  	},
diff --git a/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch b/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch
new file mode 100644
index 0000000000..ee0bf9309f
--- /dev/null
+++ b/target/linux/generic/backport-5.15/301-v5.16-soc-qcom-smem-Support-reserved-memory-description.patch
@@ -0,0 +1,166 @@
+From b5af64fceb04dc298c5e69c517b4d83893ff060b Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 30 Sep 2021 11:21:10 -0700
+Subject: [PATCH 1/1] soc: qcom: smem: Support reserved-memory description
+
+Practically all modern Qualcomm platforms has a single reserved-memory
+region for SMEM. So rather than having to describe SMEM in the form of a
+node with a reference to a reserved-memory node, allow the SMEM device
+to be instantiated directly from the reserved-memory node.
+
+The current means of falling back to dereferencing the "memory-region"
+is kept as a fallback, if it's determined that the SMEM node is a
+reserved-memory node.
+
+The "qcom,smem" compatible is added to the reserved_mem_matches list, to
+allow the reserved-memory device to be probed.
+
+In order to retain the readability of the code, the resolution of
+resources is split from the actual ioremapping.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Link: https://lore.kernel.org/r/20210930182111.57353-4-bjorn.andersson@linaro.org
+---
+ drivers/of/platform.c   |  1 +
+ drivers/soc/qcom/smem.c | 57 ++++++++++++++++++++++++++++-------------
+ 2 files changed, 40 insertions(+), 18 deletions(-)
+
+--- a/drivers/of/platform.c
++++ b/drivers/of/platform.c
+@@ -509,6 +509,7 @@ EXPORT_SYMBOL_GPL(of_platform_default_po
+ static const struct of_device_id reserved_mem_matches[] = {
+ 	{ .compatible = "qcom,rmtfs-mem" },
+ 	{ .compatible = "qcom,cmd-db" },
++	{ .compatible = "qcom,smem" },
+ 	{ .compatible = "ramoops" },
+ 	{ .compatible = "nvmem-rmem" },
+ 	{}
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/platform_device.h>
+ #include <linux/sizes.h>
+ #include <linux/slab.h>
+@@ -240,7 +241,7 @@ static const u8 SMEM_INFO_MAGIC[] = { 0x
+  * @size:	size of the memory region
+  */
+ struct smem_region {
+-	u32 aux_base;
++	phys_addr_t aux_base;
+ 	void __iomem *virt_base;
+ 	size_t size;
+ };
+@@ -499,7 +500,7 @@ static void *qcom_smem_get_global(struct
+ 	for (i = 0; i < smem->num_regions; i++) {
+ 		region = &smem->regions[i];
+ 
+-		if (region->aux_base == aux_base || !aux_base) {
++		if ((u32)region->aux_base == aux_base || !aux_base) {
+ 			if (size != NULL)
+ 				*size = le32_to_cpu(entry->size);
+ 			return region->virt_base + le32_to_cpu(entry->offset);
+@@ -664,7 +665,7 @@ phys_addr_t qcom_smem_virt_to_phys(void
+ 		if (p < region->virt_base + region->size) {
+ 			u64 offset = p - region->virt_base;
+ 
+-			return (phys_addr_t)region->aux_base + offset;
++			return region->aux_base + offset;
+ 		}
+ 	}
+ 
+@@ -863,12 +864,12 @@ qcom_smem_enumerate_partitions(struct qc
+ 	return 0;
+ }
+ 
+-static int qcom_smem_map_memory(struct qcom_smem *smem, struct device *dev,
+-				const char *name, int i)
++static int qcom_smem_resolve_mem(struct qcom_smem *smem, const char *name,
++				 struct smem_region *region)
+ {
++	struct device *dev = smem->dev;
+ 	struct device_node *np;
+ 	struct resource r;
+-	resource_size_t size;
+ 	int ret;
+ 
+ 	np = of_parse_phandle(dev->of_node, name, 0);
+@@ -881,13 +882,9 @@ static int qcom_smem_map_memory(struct q
+ 	of_node_put(np);
+ 	if (ret)
+ 		return ret;
+-	size = resource_size(&r);
+ 
+-	smem->regions[i].virt_base = devm_ioremap_wc(dev, r.start, size);
+-	if (!smem->regions[i].virt_base)
+-		return -ENOMEM;
+-	smem->regions[i].aux_base = (u32)r.start;
+-	smem->regions[i].size = size;
++	region->aux_base = r.start;
++	region->size = resource_size(&r);
+ 
+ 	return 0;
+ }
+@@ -895,12 +892,14 @@ static int qcom_smem_map_memory(struct q
+ static int qcom_smem_probe(struct platform_device *pdev)
+ {
+ 	struct smem_header *header;
++	struct reserved_mem *rmem;
+ 	struct qcom_smem *smem;
+ 	size_t array_size;
+ 	int num_regions;
+ 	int hwlock_id;
+ 	u32 version;
+ 	int ret;
++	int i;
+ 
+ 	num_regions = 1;
+ 	if (of_find_property(pdev->dev.of_node, "qcom,rpm-msg-ram", NULL))
+@@ -914,13 +913,35 @@ static int qcom_smem_probe(struct platfo
+ 	smem->dev = &pdev->dev;
+ 	smem->num_regions = num_regions;
+ 
+-	ret = qcom_smem_map_memory(smem, &pdev->dev, "memory-region", 0);
+-	if (ret)
+-		return ret;
+-
+-	if (num_regions > 1 && (ret = qcom_smem_map_memory(smem, &pdev->dev,
+-					"qcom,rpm-msg-ram", 1)))
+-		return ret;
++	rmem = of_reserved_mem_lookup(pdev->dev.of_node);
++	if (rmem) {
++		smem->regions[0].aux_base = rmem->base;
++		smem->regions[0].size = rmem->size;
++	} else {
++		/*
++		 * Fall back to the memory-region reference, if we're not a
++		 * reserved-memory node.
++		 */
++		ret = qcom_smem_resolve_mem(smem, "memory-region", &smem->regions[0]);
++		if (ret)
++			return ret;
++	}
++
++	if (num_regions > 1) {
++		ret = qcom_smem_resolve_mem(smem, "qcom,rpm-msg-ram", &smem->regions[1]);
++		if (ret)
++			return ret;
++	}
++
++	for (i = 0; i < num_regions; i++) {
++		smem->regions[i].virt_base = devm_ioremap_wc(&pdev->dev,
++							     smem->regions[i].aux_base,
++							     smem->regions[i].size);
++		if (!smem->regions[i].virt_base) {
++			dev_err(&pdev->dev, "failed to remap %pa\n", &smem->regions[i].aux_base);
++			return -ENOMEM;
++		}
++	}
+ 
+ 	header = smem->regions[0].virt_base;
+ 	if (le32_to_cpu(header->initialized) != 1 ||
diff --git a/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch b/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch
new file mode 100644
index 0000000000..0efad99157
--- /dev/null
+++ b/target/linux/generic/backport-5.15/407-v5.17-mtd-parsers-qcom-Don-t-print-error-message-on-EPROBE.patch
@@ -0,0 +1,32 @@
+From 26bccc9671ba5e01f7153addbe94e7dc3f677375 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Date: Mon, 3 Jan 2022 03:03:16 +0000
+Subject: [PATCH 13/14] mtd: parsers: qcom: Don't print error message on
+ -EPROBE_DEFER
+
+Its possible for the main smem driver to not be loaded by the time we come
+along to parse the smem partition description but, this is a perfectly
+normal thing.
+
+No need to print out an error message in this case.
+
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220103030316.58301-3-bryan.odonoghue@linaro.org
+---
+ drivers/mtd/parsers/qcomsmempart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/parsers/qcomsmempart.c
++++ b/drivers/mtd/parsers/qcomsmempart.c
+@@ -75,7 +75,8 @@ static int parse_qcomsmem_part(struct mt
+ 	pr_debug("Parsing partition table info from SMEM\n");
+ 	ptable = qcom_smem_get(SMEM_APPS, SMEM_AARM_PARTITION_TABLE, &len);
+ 	if (IS_ERR(ptable)) {
+-		pr_err("Error reading partition table header\n");
++		if (PTR_ERR(ptable) != -EPROBE_DEFER)
++			pr_err("Error reading partition table header\n");
+ 		return PTR_ERR(ptable);
+ 	}
+ 
diff --git a/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch b/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
index b72faec8d9..885c2fcf25 100644
--- a/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
+++ b/target/linux/generic/backport-5.15/703-01-v5.16-net-phylink-add-MAC-phy_interface_t-bitmap.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -76,6 +76,7 @@ struct phylink_config {
+@@ -78,6 +78,7 @@ struct phylink_config {
  	bool ovr_an_inband;
  	void (*get_fixed_state)(struct phylink_config *config,
  				struct phylink_link_state *state);
diff --git a/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch b/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
index 8996fc8d45..9800884f6e 100644
--- a/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
+++ b/target/linux/generic/backport-5.15/703-02-v5.16-net-phylink-use-supported_interfaces-for-phylink-val.patch
@@ -70,7 +70,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return phylink_is_empty_linkmode(supported) ? -EINVAL : 0;
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -67,6 +67,8 @@ enum phylink_op_type {
+@@ -68,6 +68,8 @@ enum phylink_op_type {
   * @ovr_an_inband: if true, override PCS to MLO_AN_INBAND
   * @get_fixed_state: callback to execute to determine the fixed link state,
   *		     if MAC link is at %MLO_AN_FIXED mode.
@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct phylink_config {
  	struct device *dev;
-@@ -134,8 +136,14 @@ struct phylink_mac_ops {
+@@ -136,8 +138,14 @@ struct phylink_mac_ops {
   * based on @state->advertising and/or @state->speed and update
   * @state->interface accordingly. See phylink_helper_basex_speed().
   *
diff --git a/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch b/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
index e1cfc3f439..d826877e7d 100644
--- a/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
+++ b/target/linux/generic/backport-5.15/703-08-v5.17-net-phylink-add-mac_select_pcs-method-to-phylink_mac.patch
@@ -156,7 +156,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -84,6 +84,7 @@ struct phylink_config {
+@@ -86,6 +86,7 @@ struct phylink_config {
  /**
   * struct phylink_mac_ops - MAC operations structure.
   * @validate: Validate and update the link configuration.
@@ -164,7 +164,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @mac_pcs_get_state: Read the current link state from the hardware.
   * @mac_prepare: prepare for a major reconfiguration of the interface.
   * @mac_config: configure the MAC for the selected mode and state.
-@@ -98,6 +99,8 @@ struct phylink_mac_ops {
+@@ -100,6 +101,8 @@ struct phylink_mac_ops {
  	void (*validate)(struct phylink_config *config,
  			 unsigned long *supported,
  			 struct phylink_link_state *state);
@@ -173,7 +173,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	void (*mac_pcs_get_state)(struct phylink_config *config,
  				  struct phylink_link_state *state);
  	int (*mac_prepare)(struct phylink_config *config, unsigned int mode,
-@@ -150,6 +153,21 @@ struct phylink_mac_ops {
+@@ -152,6 +155,21 @@ struct phylink_mac_ops {
   */
  void validate(struct phylink_config *config, unsigned long *supported,
  	      struct phylink_link_state *state);
diff --git a/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch b/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
index 73c8b414da..f30a566c81 100644
--- a/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
+++ b/target/linux/generic/backport-5.15/703-09-v5.17-net-phylink-add-generic-validate-implementation.patch
@@ -310,7 +310,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  static inline bool phylink_autoneg_inband(unsigned int mode)
-@@ -69,6 +92,7 @@ enum phylink_op_type {
+@@ -70,6 +93,7 @@ enum phylink_op_type {
   *		     if MAC link is at %MLO_AN_FIXED mode.
   * @supported_interfaces: bitmap describing which PHY_INTERFACE_MODE_xxx
   *                        are supported by the MAC/PCS.
@@ -318,7 +318,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   */
  struct phylink_config {
  	struct device *dev;
-@@ -79,6 +103,7 @@ struct phylink_config {
+@@ -81,6 +105,7 @@ struct phylink_config {
  	void (*get_fixed_state)(struct phylink_config *config,
  				struct phylink_link_state *state);
  	DECLARE_PHY_INTERFACE_MASK(supported_interfaces);
@@ -326,7 +326,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  };
  
  /**
-@@ -460,6 +485,12 @@ void pcs_link_up(struct phylink_pcs *pcs
+@@ -462,6 +487,12 @@ void pcs_link_up(struct phylink_pcs *pcs
  		 phy_interface_t interface, int speed, int duplex);
  #endif
  
diff --git a/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch b/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
index add2e6e352..524ce9bd92 100644
--- a/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
+++ b/target/linux/generic/backport-5.15/703-11-v5.17-net-phylink-add-pcs_validate-method.patch
@@ -63,7 +63,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return phylink_is_empty_linkmode(supported) ? -EINVAL : 0;
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -396,6 +396,7 @@ struct phylink_pcs {
+@@ -398,6 +398,7 @@ struct phylink_pcs {
  
  /**
   * struct phylink_pcs_ops - MAC PCS operations structure.
@@ -71,7 +71,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @pcs_get_state: read the current MAC PCS link state from the hardware.
   * @pcs_config: configure the MAC PCS for the selected mode and state.
   * @pcs_an_restart: restart 802.3z BaseX autonegotiation.
-@@ -403,6 +404,8 @@ struct phylink_pcs {
+@@ -405,6 +406,8 @@ struct phylink_pcs {
   *               (where necessary).
   */
  struct phylink_pcs_ops {
@@ -80,7 +80,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	void (*pcs_get_state)(struct phylink_pcs *pcs,
  			      struct phylink_link_state *state);
  	int (*pcs_config)(struct phylink_pcs *pcs, unsigned int mode,
-@@ -416,6 +419,23 @@ struct phylink_pcs_ops {
+@@ -418,6 +421,23 @@ struct phylink_pcs_ops {
  
  #if 0 /* For kernel-doc purposes only. */
  /**
diff --git a/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch b/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
index 6fbde12507..16d5da9c70 100644
--- a/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
+++ b/target/linux/generic/backport-5.15/703-12-v5.17-net-phylink-add-legacy_pre_march2020-indicator.patch
@@ -33,11 +33,11 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   * @pcs_poll: MAC PCS cannot provide link change interrupt
   * @poll_fixed_state: if true, starts link_poll,
   *		      if MAC link is at %MLO_AN_FIXED mode.
-@@ -97,6 +99,7 @@ enum phylink_op_type {
+@@ -98,6 +100,7 @@ enum phylink_op_type {
  struct phylink_config {
  	struct device *dev;
  	enum phylink_op_type type;
 +	bool legacy_pre_march2020;
  	bool pcs_poll;
  	bool poll_fixed_state;
- 	bool ovr_an_inband;
+ 	bool mac_managed_pm;
diff --git a/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch b/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
index 361fa10d4d..73e53068b8 100644
--- a/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
+++ b/target/linux/generic/backport-5.15/703-14-v5.17-net-phylink-use-legacy_pre_march2020.patch
@@ -75,7 +75,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		}
 --- a/include/linux/phylink.h
 +++ b/include/linux/phylink.h
-@@ -208,6 +208,10 @@ struct phylink_pcs *mac_select_pcs(struc
+@@ -210,6 +210,10 @@ struct phylink_pcs *mac_select_pcs(struc
   * negotiation completion state in @state->an_complete, and link up state
   * in @state->link. If possible, @state->lp_advertising should also be
   * populated.
@@ -86,7 +86,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   */
  void mac_pcs_get_state(struct phylink_config *config,
  		       struct phylink_link_state *state);
-@@ -248,6 +252,15 @@ int mac_prepare(struct phylink_config *c
+@@ -250,6 +254,15 @@ int mac_prepare(struct phylink_config *c
   * guaranteed to be correct, and so any mac_config() implementation must
   * never reference these fields.
   *
@@ -102,7 +102,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   * (this requires a rewrite - please refer to mac_link_up() for situations
   *  where the PCS and MAC are not tightly integrated.)
   *
-@@ -332,6 +345,10 @@ int mac_finish(struct phylink_config *co
+@@ -334,6 +347,10 @@ int mac_finish(struct phylink_config *co
  /**
   * mac_an_restart() - restart 802.3z BaseX autonegotiation
   * @config: a pointer to a &struct phylink_config.
diff --git a/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch b/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
index feaabc9d11..daa3cac4ef 100644
--- a/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
+++ b/target/linux/generic/backport-5.15/821-v5.16-Bluetooth-btusb-Support-public-address-configuration.patch
@@ -41,7 +41,7 @@ Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  static void btusb_mtk_wmt_recv(struct urb *urb)
  {
  	struct hci_dev *hdev = urb->context;
-@@ -3900,6 +3917,7 @@ static int btusb_probe(struct usb_interf
+@@ -3914,6 +3931,7 @@ static int btusb_probe(struct usb_interf
  		hdev->shutdown = btusb_mtk_shutdown;
  		hdev->manufacturer = 70;
  		hdev->cmd_timeout = btusb_mtk_cmd_timeout;
diff --git a/target/linux/generic/config-5.10 b/target/linux/generic/config-5.10
index 2eb3634fa2..317b5ce59f 100644
--- a/target/linux/generic/config-5.10
+++ b/target/linux/generic/config-5.10
@@ -2124,7 +2124,6 @@ CONFIG_GPIOLIB_FASTPATH_LIMIT=512
 # CONFIG_GPIO_MAX732X is not set
 # CONFIG_GPIO_MB86S7X is not set
 # CONFIG_GPIO_MC33880 is not set
-# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_GPIO_ML_IOH is not set
 # CONFIG_GPIO_MOCKUP is not set
 # CONFIG_GPIO_MPC8XXX is not set
diff --git a/target/linux/generic/config-5.15 b/target/linux/generic/config-5.15
index bba53d1228..455eaf2fe5 100644
--- a/target/linux/generic/config-5.15
+++ b/target/linux/generic/config-5.15
@@ -328,6 +328,8 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
 # CONFIG_ARM64_ERRATUM_1508412 is not set
 # CONFIG_ARM64_ERRATUM_1530923 is not set
 # CONFIG_ARM64_ERRATUM_1542419 is not set
+# CONFIG_ARM64_ERRATUM_1742098 is not set
+# CONFIG_ARM64_ERRATUM_2441007 is not set
 # CONFIG_ARM64_ERRATUM_2441009 is not set
 # CONFIG_ARM64_ERRATUM_819472 is not set
 # CONFIG_ARM64_ERRATUM_824069 is not set
@@ -2204,7 +2206,6 @@ CONFIG_GPIOLIB_FASTPATH_LIMIT=512
 # CONFIG_GPIO_MAX732X is not set
 # CONFIG_GPIO_MB86S7X is not set
 # CONFIG_GPIO_MC33880 is not set
-# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_GPIO_ML_IOH is not set
 # CONFIG_GPIO_MOCKUP is not set
 # CONFIG_GPIO_MPC8XXX is not set
diff --git a/target/linux/generic/hack-5.10/660-fq_codel_defaults.patch b/target/linux/generic/hack-5.10/660-fq_codel_defaults.patch
index 5541c0bc89..a57a045f4a 100644
--- a/target/linux/generic/hack-5.10/660-fq_codel_defaults.patch
+++ b/target/linux/generic/hack-5.10/660-fq_codel_defaults.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -469,7 +469,11 @@ static int fq_codel_init(struct Qdisc *s
+@@ -467,7 +467,11 @@ static int fq_codel_init(struct Qdisc *s
  
  	sch->limit = 10*1024;
  	q->flows_cnt = 1024;
diff --git a/target/linux/generic/hack-5.10/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-5.10/721-net-add-packet-mangeling.patch
index 9c3cfb1885..ddbe276d1e 100644
--- a/target/linux/generic/hack-5.10/721-net-add-packet-mangeling.patch
+++ b/target/linux/generic/hack-5.10/721-net-add-packet-mangeling.patch
@@ -60,7 +60,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2718,6 +2718,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -2720,6 +2720,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -2849,16 +2853,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -2851,16 +2855,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
diff --git a/target/linux/generic/hack-5.10/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/target/linux/generic/hack-5.10/760-net-usb-r8152-add-LED-configuration-from-OF.patch
index 1e9d5a288f..51b4d87e6c 100644
--- a/target/linux/generic/hack-5.10/760-net-usb-r8152-add-LED-configuration-from-OF.patch
+++ b/target/linux/generic/hack-5.10/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  #include <linux/crc32.h>
  #include <linux/if_vlan.h>
  #include <linux/uaccess.h>
-@@ -6780,6 +6781,22 @@ static void rtl_tally_reset(struct r8152
+@@ -6782,6 +6783,22 @@ static void rtl_tally_reset(struct r8152
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  static void r8152b_init(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -6821,6 +6838,8 @@ static void r8152b_init(struct r8152 *tp
+@@ -6823,6 +6840,8 @@ static void r8152b_init(struct r8152 *tp
  	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
  	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
  	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
@@ -54,7 +54,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153_init(struct r8152 *tp)
-@@ -6961,6 +6980,8 @@ static void r8153_init(struct r8152 *tp)
+@@ -6963,6 +6982,8 @@ static void r8153_init(struct r8152 *tp)
  		tp->coalesce = COALESCE_SLOW;
  		break;
  	}
@@ -63,7 +63,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153b_init(struct r8152 *tp)
-@@ -7043,6 +7064,8 @@ static void r8153b_init(struct r8152 *tp
+@@ -7045,6 +7066,8 @@ static void r8153b_init(struct r8152 *tp
  	rtl_tally_reset(tp);
  
  	tp->coalesce = 15000;	/* 15 us */
diff --git a/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch b/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
index 5541c0bc89..a57a045f4a 100644
--- a/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
+++ b/target/linux/generic/hack-5.15/660-fq_codel_defaults.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -469,7 +469,11 @@ static int fq_codel_init(struct Qdisc *s
+@@ -467,7 +467,11 @@ static int fq_codel_init(struct Qdisc *s
  
  	sch->limit = 10*1024;
  	q->flows_cnt = 1024;
diff --git a/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch b/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
index 134e2100c8..683aa8a8df 100644
--- a/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
+++ b/target/linux/generic/hack-5.15/661-kernel-ct-size-the-hashtable-more-adequately.patch
@@ -14,7 +14,7 @@ Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
 
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -2727,7 +2727,7 @@ int nf_conntrack_init_start(void)
+@@ -2735,7 +2735,7 @@ int nf_conntrack_init_start(void)
  
  	if (!nf_conntrack_htable_size) {
  		nf_conntrack_htable_size
diff --git a/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
index 206e16cb17..81993e3569 100644
--- a/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
+++ b/target/linux/generic/hack-5.15/721-net-add-packet-mangeling.patch
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2852,6 +2852,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -2854,6 +2854,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -3002,16 +3006,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -3004,16 +3008,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
diff --git a/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
index c54332f71c..c315dcf8ff 100644
--- a/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
+++ b/target/linux/generic/hack-5.15/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  #include <linux/crc32.h>
  #include <linux/if_vlan.h>
  #include <linux/uaccess.h>
-@@ -6861,6 +6862,22 @@ static void rtl_tally_reset(struct r8152
+@@ -6864,6 +6865,22 @@ static void rtl_tally_reset(struct r8152
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  static void r8152b_init(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -6902,6 +6919,8 @@ static void r8152b_init(struct r8152 *tp
+@@ -6905,6 +6922,8 @@ static void r8152b_init(struct r8152 *tp
  	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
  	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
  	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
@@ -54,7 +54,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153_init(struct r8152 *tp)
-@@ -7042,6 +7061,8 @@ static void r8153_init(struct r8152 *tp)
+@@ -7045,6 +7064,8 @@ static void r8153_init(struct r8152 *tp)
  		tp->coalesce = COALESCE_SLOW;
  		break;
  	}
@@ -63,7 +63,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153b_init(struct r8152 *tp)
-@@ -7124,6 +7145,8 @@ static void r8153b_init(struct r8152 *tp
+@@ -7127,6 +7148,8 @@ static void r8153b_init(struct r8152 *tp
  	rtl_tally_reset(tp);
  
  	tp->coalesce = 15000;	/* 15 us */
diff --git a/target/linux/generic/pending-5.10/655-increase_skb_pad.patch b/target/linux/generic/pending-5.10/655-increase_skb_pad.patch
index b9c463d570..4ad6eb9d78 100644
--- a/target/linux/generic/pending-5.10/655-increase_skb_pad.patch
+++ b/target/linux/generic/pending-5.10/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2684,7 +2684,7 @@ static inline int pskb_network_may_pull(
+@@ -2686,7 +2686,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/target/linux/generic/pending-5.10/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-5.10/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index 5537e3081e..c9d5a805b8 100644
--- a/target/linux/generic/pending-5.10/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-5.10/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -22,10 +22,10 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -858,6 +858,7 @@ struct sk_buff {
- #ifdef CONFIG_TLS_DEVICE
+@@ -860,6 +860,7 @@ struct sk_buff {
  	__u8			decrypted:1;
  #endif
+ 	__u8			scm_io_uring:1;
 +	__u8			gro_skip:1;
  
  #ifdef CONFIG_NET_SCHED
diff --git a/target/linux/generic/pending-5.15/655-increase_skb_pad.patch b/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
index 7fc1c588b3..d1bb72d353 100644
--- a/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
+++ b/target/linux/generic/pending-5.15/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2818,7 +2818,7 @@ static inline int pskb_network_may_pull(
+@@ -2820,7 +2820,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index 41190fcfd4..72938abd37 100644
--- a/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-5.15/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -891,6 +891,7 @@ struct sk_buff {
+@@ -892,6 +892,7 @@ struct sk_buff {
  #ifdef CONFIG_IPV6_NDISC_NODETYPE
  	__u8			ndisc_nodetype:2;
  #endif
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index ac03c3317a..2bcbd95482 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -72,6 +72,14 @@ mikrotik,hap-ac3)
 	ucidef_set_led_netdev "lan4" "LAN4" "green:lan4" "lan4"
 	ucidef_set_led_gpio "poe" "POE" "red:poe" "452" "0"
 	;;
+mikrotik,hap-ac3-lte6-kit)
+        ucidef_set_led_netdev "wan" "WAN" "green:wan" "wan"
+        ucidef_set_led_netdev "lan1" "LAN1" "green:lan1" "lan1"
+        ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "lan2"
+        ucidef_set_led_netdev "lan3" "LAN3" "green:lan3" "lan3"
+        ucidef_set_led_netdev "lan4" "LAN4" "green:lan4" "lan4"
+        ;;
+
 mikrotik,sxtsq-5-ac)
 	ucidef_set_rssimon "wlan0" "200000" "1"
 	ucidef_set_led_rssi "rssilow" "rssilow" "green:rssilow" "wlan0" "1" "100"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 57c228e123..2aef8d65dd 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -20,6 +20,7 @@ ipq40xx_setup_interfaces()
 	linksys,mr8300|\
 	mikrotik,hap-ac2|\
 	mikrotik,hap-ac3|\
+	mikrotik,hap-ac3-lte6-kit|\
 	p2w,r619ac-64m|\
 	p2w,r619ac-128m|\
 	pakedge,wr-1|\
@@ -64,6 +65,12 @@ ipq40xx_setup_interfaces()
 	mikrotik,wap-ac)
 		ucidef_set_interface_lan "sw-eth1 sw-eth2"
 		;;
+	netgear,rbr50|\
+	netgear,rbs50|\
+	netgear,srr60|\
+	netgear,srs60)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
+		;;
 	zte,mf286d)
 		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" "wan"
 		;;
@@ -132,7 +139,8 @@ ipq40xx_setup_macs()
 		;;
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2|\
-	mikrotik,hap-ac3)
+	mikrotik,hap-ac3|\
+	mikrotik,hap-ac3-lte6-kit)
 		wan_mac=$(cat /sys/firmware/mikrotik/hard_config/mac_base)
 		lan_mac=$(macaddr_add $wan_mac 1)
 		label_mac="$wan_mac"
@@ -142,6 +150,10 @@ ipq40xx_setup_macs()
 		lan_mac=$(cat /sys/firmware/mikrotik/hard_config/mac_base)
 		label_mac="$lan_mac"
 		;;
+	netgear,rbr50|\
+	netgear,rbs50|\
+	netgear,srr60|\
+	netgear,srs60|\
 	pakedge,wr-1)
 		wan_mac=$(macaddr_add $(get_mac_label) 1)
 		;;
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
index 999cd383a5..4918e2ccc1 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
@@ -24,6 +24,11 @@ mikrotik,cap-ac)
 mikrotik,hap-ac3)
 	ucidef_add_gpio_switch "poe_passtrough" "PoE Passthrough" "452" "0"
 	;;
+mikrotik,hap-ac3-lte6-kit)
+	ucidef_add_gpio_switch "lte_ant_sw1" "LTE Antenna SW 1" "457" "0"
+	ucidef_add_gpio_switch "lte_ant_sw2" "LTE Antenna SW 2" "458" "0"
+	ucidef_add_gpio_switch "lte_reset" "LTE reset" "461" "0"
+	;;
 sony,ncp-hg100-cellular)
 	ucidef_add_gpio_switch "uart_dbgcon_en" "debug console enable" "427" "1"
 	;;
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 64215746d5..5d075509b5 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -120,6 +120,7 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+	mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,wap-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0x0 0x2f20 ) || \
@@ -216,6 +217,7 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+	mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,sxtsq-5-ac |\
 	mikrotik,wap-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
@@ -252,6 +254,7 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+	mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,wap-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
 		( [ -f "$wlan_data" ] && caldata_sysfsload_from_file "$wlan_data" 0x2f20 0x2f20 ) || \
@@ -264,6 +267,7 @@ case "$FIRMWARE" in
 	mikrotik,cap-ac |\
 	mikrotik,hap-ac2 |\
 	mikrotik,hap-ac3 |\
+        mikrotik,hap-ac3-lte6-kit |\
 	mikrotik,sxtsq-5-ac |\
 	mikrotik,wap-ac)
 		wlan_data="/sys/firmware/mikrotik/hard_config/wlan_data"
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index fa5f171a30..668ae04414 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -173,6 +173,7 @@ platform_do_upgrade() {
 		;;
 	mikrotik,cap-ac|\
 	mikrotik,hap-ac2|\
+	mikrotik,hap-ac3-lte6-kit|\
 	mikrotik,lhgg-60ad|\
 	mikrotik,sxtsq-5-ac|\
 	mikrotik,wap-ac)
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts
new file mode 100644
index 0000000000..f6a42cfedb
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hap-ac3-lte6-kit.dts
@@ -0,0 +1,312 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2021, Robert Marko <robimarko@gmail.com> */
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "MikroTik hAP ac3 LTE6 kit";
+	compatible = "mikrotik,hap-ac3-lte6-kit";
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x10000000>;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_red;
+	};
+
+	soc {
+		counter@4a1000 {
+			compatible = "qcom,qca-gcnt";
+			reg = <0x4a1000 0x4>;
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			/* select hostmode */
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 5 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: status-blue {
+			label = "blue:status";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: status-red {
+			label = "red:status";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led_status_green: status-green {
+			label = "green:status";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan {
+			label = "green:wlan";
+			gpios = <&tlmm 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		ethernet {
+			label = "green:ethernet";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+		};
+
+		wan {
+			label = "green:wan";
+			gpios = <&tlmm 28 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&tlmm 29 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&tlmm 31 GPIO_ACTIVE_HIGH>;
+		};
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&tlmm 32 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pin {
+			function = "blsp_spi0";
+			pins = "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pin_cs {
+			function = "gpio";
+			pins = "gpio12";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	enable-usb-power {
+		gpio-hog;
+		gpios = <44 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "enable USB power";
+	};
+
+        enable-mpcie-power {
+                gpio-hog;
+                gpios = <51 GPIO_ACTIVE_HIGH>;
+                output-high;
+                line-name = "enable mPCI-E power";
+        };
+
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_spi1 {
+	status = "okay";
+
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
+
+	flash@0 {
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <10000000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+
+		partitions {
+			compatible = "fixed-partitions";
+
+			partition@0 {
+				label = "Qualcomm";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				compatible = "mikrotik,routerboot-partitions";
+				label = "RouterBoot";
+				reg = <0x80000 0x80000>;
+
+				hard_config {
+					size = <0x2000>;
+				};
+
+				dtb_config {
+					read-only;
+				};
+
+				soft_config {
+				};
+			};
+
+			partition@110000 {
+				compatible = "mikrotik,minor";
+				label = "firmware";
+				reg = <0x110000 0xef0000>;
+			};
+		};
+	};
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_uart1 {
+	status = "okay";
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+};
+
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+	label = "lan4";
+};
+
+&swport2 {
+	status = "okay";
+	label = "lan3";
+};
+
+&swport3 {
+	status = "okay";
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan1";
+};
+
+&swport5 {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
index 4a575b60ee..44dbfef529 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-orbi.dtsi
@@ -11,6 +11,7 @@
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;
 		led-upgrade = &led_status_blue;
+		label-mac-device = &gmac;
 	};
 
 	soc {
@@ -266,6 +267,42 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport1 {
+	status = "okay";
+
+	label = "wan";
+};
+
+&swport2 {
+	status = "okay";
+
+	label = "lan1";
+};
+
+&swport3 {
+	status = "okay";
+
+	label = "lan2";
+};
+
+&swport4 {
+	status = "okay";
+
+	label = "lan3";
+};
+
+&ethphy4 {
+	status = "disabled";
+};
+
 &pcie0 {
 	status = "okay";
 
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index fd3140c2aa..e8e6e29e72 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -815,8 +815,7 @@ define Device/netgear_rbr50
 	DEVICE_VARIANT := v1
 	NETGEAR_BOARD_ID := RBR50
 endef
-# Missing DSA Setup
-#TARGET_DEVICES += netgear_rbr50
+TARGET_DEVICES += netgear_rbr50
 
 define Device/netgear_rbs50
 	$(call Device/netgear_rbx50)
@@ -824,8 +823,7 @@ define Device/netgear_rbs50
 	DEVICE_VARIANT := v1
 	NETGEAR_BOARD_ID := RBS50
 endef
-# Missing DSA Setup
-#TARGET_DEVICES += netgear_rbs50
+TARGET_DEVICES += netgear_rbs50
 
 define Device/netgear_srx60
 	$(call Device/netgear_orbi)
@@ -840,16 +838,14 @@ define Device/netgear_srr60
 	DEVICE_MODEL := SRR60
 	NETGEAR_BOARD_ID := SRR60
 endef
-# Missing DSA Setup
-#TARGET_DEVICES += netgear_srr60
+TARGET_DEVICES += netgear_srr60
 
 define Device/netgear_srs60
 	$(call Device/netgear_srx60)
 	DEVICE_MODEL := SRS60
 	NETGEAR_BOARD_ID := SRS60
 endef
-# Missing DSA Setup
-#TARGET_DEVICES += netgear_srs60
+TARGET_DEVICES += netgear_srs60
 
 define Device/netgear_wac510
 	$(call Device/FitImage)
diff --git a/target/linux/ipq40xx/image/mikrotik.mk b/target/linux/ipq40xx/image/mikrotik.mk
index d1f0829cd3..2b0e462efd 100644
--- a/target/linux/ipq40xx/image/mikrotik.mk
+++ b/target/linux/ipq40xx/image/mikrotik.mk
@@ -47,6 +47,14 @@ define Device/mikrotik_hap-ac3
 endef
 TARGET_DEVICES += mikrotik_hap-ac3
 
+define Device/mikrotik_hap-ac3-lte6-kit
+        $(call Device/mikrotik_nor)
+        DEVICE_MODEL := hAP ac3 LTE6 kit
+        SOC := qcom-ipq4019
+        DEVICE_PACKAGES := kmod-ledtrig-gpio kmod-usb-acm kmod-usb-net-rndis
+endef
+TARGET_DEVICES += mikrotik_hap-ac3-lte6-kit
+
 define Device/mikrotik_lhgg-60ad
 	$(call Device/mikrotik_nor)
 	DEVICE_MODEL := Wireless Wire Dish LHGG-60ad
diff --git a/target/linux/ipq40xx/patches-5.10/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch b/target/linux/ipq40xx/patches-5.10/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
index 63514c2444..07d274f0dd 100644
--- a/target/linux/ipq40xx/patches-5.10/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
+++ b/target/linux/ipq40xx/patches-5.10/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
@@ -13,7 +13,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 
 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -2192,7 +2192,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
+@@ -2193,7 +2193,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
  
  static const struct sdhci_ops sdhci_msm_ops = {
  	.reset = sdhci_msm_reset,
diff --git a/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch b/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
index 99e33632c4..0448574e7e 100644
--- a/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
+++ b/target/linux/ipq40xx/patches-5.15/301-arm-compressed-add-appended-DTB-section.patch
@@ -26,7 +26,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/arch/arm/boot/compressed/vmlinux.lds.S
 +++ b/arch/arm/boot/compressed/vmlinux.lds.S
-@@ -101,6 +101,13 @@ SECTIONS
+@@ -103,6 +103,13 @@ SECTIONS
  
    _edata = .;
  
@@ -40,7 +40,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
    /*
     * The image_end section appears after any additional loadable sections
     * that the linker may decide to insert in the binary image.  Having
-@@ -138,4 +145,4 @@ SECTIONS
+@@ -140,4 +147,4 @@ SECTIONS
  
    ARM_ASSERTS
  }
diff --git a/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch b/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
index 23fef71b2b..3a3be91709 100644
--- a/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
+++ b/target/linux/ipq40xx/patches-5.15/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
@@ -13,7 +13,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 
 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -2446,7 +2446,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
+@@ -2447,7 +2447,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
  
  static const struct sdhci_ops sdhci_msm_ops = {
  	.reset = sdhci_msm_reset,
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts
index 59d5d3ec3d..63a72b53ae 100644
--- a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-g10.dts
@@ -158,71 +158,17 @@
 	pinctrl-0 = <&mdio0_pins>;
 	pinctrl-names = "default";
 
-	switch@10 {
-		compatible = "qca,qca8337";
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <0x10>;
-
-		qca8k,rgmii56_1_8v;
-
-		ports {
-			#address-cells = <1>;
-			#size-cells = <0>;
-
-			port@0 {
-				reg = <0>;
-				label = "cpu";
-				ethernet = <&gmac1>;
-				phy-mode = "rgmii-id";
-
-				fixed-link {
-					speed = <1000>;
-					full-duplex;
-				};
-			};
-
-			port@1 {
-				reg = <1>;
-				label = "lan1";
-			};
-
-			port@2 {
-				reg = <2>;
-				label = "lan2";
-			};
-
-			port@3 {
-				reg = <3>;
-				label = "lan3";
-			};
-
-			port@4 {
-				reg = <4>;
-				label = "lan4";
-			};
-
-			port@5 {
-				reg = <5>;
-				label = "wan";
-			};
-
-			/*
-			port@6 {
-					reg = <0>;
-					label = "cpu";
-					ethernet = <&gmac2>;
-					phy-mode = "rgmii";
-
-					fixed-link {
-							speed = <1000>;
-							full-duplex;
-							pause;
-							asym-pause;
-					};
-			};
-			*/
-		};
+	ethernet-phy@0 {
+		reg = <0>;
+		qca,ar8327-initvals = <
+			0x00004 0x7600000   /* PAD0_MODE */
+			0x00008 0x1000000   /* PAD5_MODE */
+			0x0000c 0x80        /* PAD6_MODE */
+			0x000e4 0x6a545     /* MAC_POWER_SEL */
+			0x000e0 0xc74164de  /* SGMII_CTRL */
+			0x0007c 0x4e        /* PORT0_STATUS */
+			0x00094 0x4e        /* PORT6_STATUS */
+			>;
 	};
 };
 
diff --git a/target/linux/ipq806x/image/generic.mk b/target/linux/ipq806x/image/generic.mk
index 58eb8b2517..02f5aad545 100644
--- a/target/linux/ipq806x/image/generic.mk
+++ b/target/linux/ipq806x/image/generic.mk
@@ -163,6 +163,7 @@ define Device/linksys_ea7500-v1
 	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 		append-ubi | pad-to $$$$(PAGESIZE)
 	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
+	DEFAULT := n
 endef
 TARGET_DEVICES += linksys_ea7500-v1
 
@@ -184,6 +185,7 @@ define Device/linksys_ea8500
 	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
 		append-ubi
 	DEVICE_PACKAGES := ath10k-firmware-qca99x0-ct
+	DEFAULT := n
 endef
 TARGET_DEVICES += linksys_ea8500
 
diff --git a/target/linux/ipq806x/patches-5.10/093-drivers-cpufreq-qcom-cpufreq-nvmem-support-specific-.patch b/target/linux/ipq806x/patches-5.10/093-drivers-cpufreq-qcom-cpufreq-nvmem-support-specific-.patch
index 19c3d096c4..8a25b17a19 100644
--- a/target/linux/ipq806x/patches-5.10/093-drivers-cpufreq-qcom-cpufreq-nvmem-support-specific-.patch
+++ b/target/linux/ipq806x/patches-5.10/093-drivers-cpufreq-qcom-cpufreq-nvmem-support-specific-.patch
@@ -21,7 +21,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  };
  
  struct qcom_cpufreq_drv {
-@@ -250,6 +251,7 @@ static const struct qcom_cpufreq_match_d
+@@ -253,6 +254,7 @@ static const struct qcom_cpufreq_match_d
  
  static const struct qcom_cpufreq_match_data match_data_krait = {
  	.get_version = qcom_cpufreq_krait_name_version,
@@ -29,7 +29,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  };
  
  static const char *qcs404_genpd_names[] = { "cpr", NULL };
-@@ -385,6 +387,19 @@ static int qcom_cpufreq_probe(struct pla
+@@ -389,6 +391,19 @@ static int qcom_cpufreq_probe(struct pla
  		}
  	}
  
diff --git a/target/linux/ipq806x/patches-5.10/101-5.12-mtd-parsers-Add-Qcom-SMEM-parser.patch b/target/linux/ipq806x/patches-5.10/101-5.12-mtd-parsers-Add-Qcom-SMEM-parser.patch
index 8079c19350..13b7c137e0 100644
--- a/target/linux/ipq806x/patches-5.10/101-5.12-mtd-parsers-Add-Qcom-SMEM-parser.patch
+++ b/target/linux/ipq806x/patches-5.10/101-5.12-mtd-parsers-Add-Qcom-SMEM-parser.patch
@@ -19,7 +19,7 @@ Link: https://lore.kernel.org/linux-mtd/20210104041137.113075-3-manivannan.sadha
 
 --- a/drivers/mtd/parsers/Kconfig
 +++ b/drivers/mtd/parsers/Kconfig
-@@ -205,6 +205,14 @@ config MTD_SERCOMM_PARTS
+@@ -220,6 +220,14 @@ config MTD_SERCOMM_PARTS
  	  offsets, which may differ from device to device depending on the
  	  number and location of bad blocks on NAND.
  
@@ -36,7 +36,7 @@ Link: https://lore.kernel.org/linux-mtd/20210104041137.113075-3-manivannan.sadha
  	depends on MTD && OF
 --- a/drivers/mtd/parsers/Makefile
 +++ b/drivers/mtd/parsers/Makefile
-@@ -14,4 +14,5 @@ obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_
+@@ -15,4 +15,5 @@ obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_
  obj-$(CONFIG_MTD_SERCOMM_PARTS)		+= scpart.o
  obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
  obj-$(CONFIG_MTD_REDBOOT_PARTS)		+= redboot.o
diff --git a/target/linux/ipq806x/patches-5.15/130-mtd-nand-raw-qcom_nandc-handle-ret-from-parse-with-c.patch b/target/linux/ipq806x/patches-5.15/130-mtd-nand-raw-qcom_nandc-handle-ret-from-parse-with-c.patch
new file mode 100644
index 0000000000..b6ed7554ce
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/130-mtd-nand-raw-qcom_nandc-handle-ret-from-parse-with-c.patch
@@ -0,0 +1,54 @@
+From 99d897e04c0856188e371e60b00e13106cd44a24 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 21 Oct 2022 18:38:21 +0200
+Subject: [PATCH] mtd: nand: raw: qcom_nandc: handle ret from parse with
+ codeword_fixup
+
+With use_codeword_fixup enabled, any return from
+mtd_device_parse_register gets overwritten. Aside from the clear bug, this
+is also problematic as a parser can EPROBE_DEFER and because this is not
+correctly handled, the nand is never rescanned later in the bootup
+process.
+
+An example of this problem is when smem requires additional time to be
+probed and nandc use qcomsmempart as parser. Parser will return
+EPROBE_DEFER but in the current code this ret gets overwritten by
+qcom_nand_host_parse_boot_partitions and qcom_nand_host_init_and_register
+return 0.
+
+Correctly handle the return code from mtd_device_parse_register so that
+any error from this function is not ignored.
+
+Fixes: 862bdedd7f4b ("mtd: nand: raw: qcom_nandc: add support for unprotected spare data pages")
+Cc: stable@vger.kernel.org # v6.0+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -3157,16 +3157,18 @@ static int qcom_nand_host_init_and_regis
+ 
+ 	ret = mtd_device_parse_register(mtd, probes, NULL, NULL, 0);
+ 	if (ret)
+-		nand_cleanup(chip);
++		goto err;
+ 
+ 	if (nandc->props->use_codeword_fixup) {
+ 		ret = qcom_nand_host_parse_boot_partitions(nandc, host, dn);
+-		if (ret) {
+-			nand_cleanup(chip);
+-			return ret;
+-		}
++		if (ret)
++			goto err;
+ 	}
+ 
++	return 0;
++
++err:
++	nand_cleanup(chip);
+ 	return ret;
+ }
+ 
diff --git a/target/linux/ipq806x/patches-5.15/131-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch b/target/linux/ipq806x/patches-5.15/131-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
new file mode 100644
index 0000000000..a5a8dd1008
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/131-ARM-dts-qcom-ipq8064-disable-mmc-ddr-1_8v-for-sdcc1.patch
@@ -0,0 +1,26 @@
+From f7b300f770683cd063f922e43fa4ad818761c1fb Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 22 Oct 2022 16:55:21 +0200
+Subject: [PATCH] ARM: dts: qcom: ipq8064: disable mmc-ddr-1_8v for sdcc1
+
+It was reported non working mmc with this option enabled.
+Both mmc for ipq8064 are supplied by a fixed 3.3v regulator so mmc can't
+be run at 1.8v.
+Disable it to restore correct functionality of this SoC feature.
+
+Tested-by: Hendrik Koerner <koerhen@web.de>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -1529,7 +1529,6 @@
+ 				non-removable;
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+-				mmc-ddr-1_8v;
+ 				vmmc-supply = <&vsdcc_fixed>;
+ 				dmas = <&sdcc1bam 2>, <&sdcc1bam 1>;
+ 				dma-names = "tx", "rx";
diff --git a/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch b/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch
new file mode 100644
index 0000000000..23cec10f44
--- /dev/null
+++ b/target/linux/ipq806x/patches-5.15/900-arm-add-cmdline-override.patch
@@ -0,0 +1,37 @@
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1740,6 +1740,14 @@ config ARM_ATAG_DTB_COMPAT_CMDLINE_MANGL
+ 
+ endchoice
+ 
++config CMDLINE_OVERRIDE
++	bool "Use alternative cmdline from device tree"
++	help
++	  Some bootloaders may have uneditable bootargs. While CMDLINE_FORCE can
++	  be used, this is not a good option for kernels that are shared across
++	  devices. This setting enables using "chosen/cmdline-override" as the
++	  cmdline if it exists in the device tree.
++
+ config CMDLINE
+ 	string "Default kernel command string"
+ 	default ""
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1162,6 +1162,17 @@ int __init early_init_dt_scan_chosen(uns
+ 	if (p != NULL && l > 0)
+ 		strlcat(data, p, min_t(int, strlen(data) + (int)l, COMMAND_LINE_SIZE));
+ 
++    /* CONFIG_CMDLINE_OVERRIDE is used to fallback to a different
++     * device tree option of chosen/bootargs-override. This is
++     * helpful on boards where u-boot sets bootargs, and is unable
++     * to be modified.
++     */
++#ifdef CONFIG_CMDLINE_OVERRIDE
++	p = of_get_flat_dt_prop(node, "bootargs-override", &l);
++	if (p != NULL && l > 0)
++		strlcpy(data, p, min((int)l, COMMAND_LINE_SIZE));
++#endif
++
+ 	/*
+ 	 * CONFIG_CMDLINE is meant to be a default in case nothing else
+ 	 * managed to set the command line, unless CONFIG_CMDLINE_FORCE
diff --git a/target/linux/layerscape/armv8_64b/config-5.10 b/target/linux/layerscape/armv8_64b/config-5.10
index 10aaace99c..fc12865a6e 100644
--- a/target/linux/layerscape/armv8_64b/config-5.10
+++ b/target/linux/layerscape/armv8_64b/config-5.10
@@ -19,6 +19,7 @@ CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_CNP=y
 CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_ERRATUM_1165522=y
 CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_819472=y
diff --git a/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dts b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dts
new file mode 100644
index 0000000000..7c590d22e2
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-xiaomi-redmi-router-ax6000.dts
@@ -0,0 +1,255 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "Xiaomi Redmi Router AX6000";
+	compatible = "xiaomi,redmi-router-ax6000", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		mesh {
+			label = "mesh";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_9>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+		mac-address-increment = <(-1)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	switch: switch@0 {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	cs-gpios = <0>, <0>;
+	status = "okay";
+
+	flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "Nvram";
+				reg = <0x100000 0x40000>;
+			};
+
+			partition@140000 {
+				label = "Bdata";
+				reg = <0x140000 0x40000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_factory_4: macaddr@4 {
+					reg = <0x4 0x6>;
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "crash";
+				reg = <0x580000 0x40000>;
+				read-only;
+			};
+
+			partition@5c0000 {
+				label = "crash_log";
+				reg = <0x5c0000 0x40000>;
+				read-only;
+			};
+
+			/* ubi partition is the result of squashing
+			 * consecutive stock partitions:
+			 * - ubi
+			 * - ubi1
+			 * - overlay
+			 */
+			partition@600000 {
+				label = "ubi";
+				reg = <0x600000 0x6e00000>;
+			};
+
+			/* last 12 MiB is reserved for NMBM bad block table */
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@1 {
+			reg = <1>;
+			label = "lan4";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan2";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "wan";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+
+	mediatek,mtd-eeprom = <&factory 0x0>;
+};
+
+&uart0 {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index f7dc7a01e0..0f0a0fc86b 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -16,15 +16,38 @@ mediatek_setup_interfaces()
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 sfp2" "eth1 wan"
 		ucidef_set_interface_macaddr "wan" "$(macaddr_add $(cat /sys/class/net/eth0/address) 1)"
 		;;
+	xiaomi,redmi-router-ax6000)
+		ucidef_set_interfaces_lan_wan "lan2 lan3 lan4" wan
+		;;
 	*)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" wan
 		;;
 	esac
 }
 
+mediatek_setup_macs()
+{
+	local board="$1"
+	local lan_mac=""
+	local wan_mac=""
+	local label_mac=""
+
+	case $board in
+	xiaomi,redmi-router-ax6000)
+		wan_mac=$(mtd_get_mac_ascii Bdata ethaddr_wan)
+		label_mac=$wan_mac
+		;;
+	esac
+
+	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
+	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" $wan_mac
+	[ -n "$label_mac" ] && ucidef_set_label_macaddr $label_mac
+}
+
 board_config_update
 board=$(board_name)
 mediatek_setup_interfaces $board
+mediatek_setup_macs $board
 board_config_flush
 
 exit 0
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index df890a4152..f7fc9e30d1 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -125,3 +125,17 @@ define Device/mediatek_mt7986b-rfb
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 TARGET_DEVICES += mediatek_mt7986b-rfb
+
+define Device/xiaomi_redmi-router-ax6000
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := Redmi Router AX6000
+  DEVICE_DTS := mt7986a-xiaomi-redmi-router-ax6000
+  DEVICE_DTS_DIR := ../dts
+  KERNEL_LOADADDR := 0x48000000
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += xiaomi_redmi-router-ax6000
diff --git a/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch b/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
index 860728f02d..cfb0556d1e 100644
--- a/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
+++ b/target/linux/mediatek/patches-5.15/200-phy-phy-mtk-tphy-Add-hifsys-support.patch
@@ -47,7 +47,7 @@ Subject: [PATCH] phy: phy-mtk-tphy: Add hifsys-support
  	tmp = readl(u3_banks->phya + U3P_U3_PHYA_DA_REG0);
  	tmp &= ~(P3A_RG_XTAL_EXT_PE1H | P3A_RG_XTAL_EXT_PE2H);
  	tmp |= P3A_RG_XTAL_EXT_PE1H_VAL(0x2) | P3A_RG_XTAL_EXT_PE2H_VAL(0x2);
-@@ -1436,6 +1446,16 @@ static int mtk_tphy_probe(struct platfor
+@@ -1437,6 +1447,16 @@ static int mtk_tphy_probe(struct platfor
  					 &tphy->src_coef);
  	}
  
diff --git a/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch b/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
index a5836a8268..e61b3dd94c 100644
--- a/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
+++ b/target/linux/mediatek/patches-5.15/410-bt-mtk-serial-fix.patch
@@ -19,7 +19,7 @@
  	},
  	[PORT_NPCM] = {
  		.name		= "Nuvoton 16550",
-@@ -2745,6 +2745,11 @@ serial8250_do_set_termios(struct uart_po
+@@ -2748,6 +2748,11 @@ serial8250_do_set_termios(struct uart_po
  	unsigned long flags;
  	unsigned int baud, quot, frac = 0;
  
diff --git a/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch b/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch
index 4c2fd18b3b..691a7c0398 100644
--- a/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch
+++ b/target/linux/mediatek/patches-5.15/801-phy-phy-mtk-tphy-Add-PCIe-2-lane-efuse-support.patch
@@ -84,7 +84,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  static void phy_parse_property(struct mtk_tphy *tphy,
  				struct mtk_phy_instance *instance)
  {
-@@ -1143,6 +1186,40 @@ static int phy_efuse_get(struct mtk_tphy
+@@ -1144,6 +1187,40 @@ static int phy_efuse_get(struct mtk_tphy
  
  		dev_dbg(dev, "u3 efuse - intr %x, rx_imp %x, tx_imp %x\n",
  			instance->efuse_intr, instance->efuse_rx_imp,instance->efuse_tx_imp);
@@ -125,7 +125,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		break;
  	default:
  		dev_err(dev, "no sw efuse for type %d\n", instance->type);
-@@ -1174,6 +1251,31 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1175,6 +1252,31 @@ static void phy_efuse_set(struct mtk_phy
  		writel(tmp, u2_banks->com + U3P_USBPHYACR1);
  		break;
  	case PHY_TYPE_USB3:
@@ -157,7 +157,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  	case PHY_TYPE_PCIE:
  		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
  		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
-@@ -1195,6 +1297,34 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1196,6 +1298,34 @@ static void phy_efuse_set(struct mtk_phy
  		tmp &= ~P3A_RG_IEXT_INTR;
  		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr);
  		writel(tmp, u3_banks->phya + U3P_U3_PHYA_REG0);
@@ -192,7 +192,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		break;
  	default:
  		dev_warn(dev, "no sw efuse for type %d\n", instance->type);
-@@ -1334,6 +1464,9 @@ static struct phy *mtk_phy_xlate(struct
+@@ -1335,6 +1465,9 @@ static struct phy *mtk_phy_xlate(struct
  	case MTK_PHY_V3:
  		phy_v2_banks_init(tphy, instance);
  		break;
@@ -202,7 +202,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  	default:
  		dev_err(dev, "phy version is not supported\n");
  		return ERR_PTR(-EINVAL);
-@@ -1374,6 +1507,12 @@ static const struct mtk_phy_pdata tphy_v
+@@ -1375,6 +1508,12 @@ static const struct mtk_phy_pdata tphy_v
  	.version = MTK_PHY_V3,
  };
  
@@ -215,7 +215,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  static const struct mtk_phy_pdata mt8173_pdata = {
  	.avoid_rx_sen_degradation = true,
  	.version = MTK_PHY_V1,
-@@ -1393,6 +1532,7 @@ static const struct of_device_id mtk_tph
+@@ -1394,6 +1533,7 @@ static const struct of_device_id mtk_tph
  	{ .compatible = "mediatek,generic-tphy-v1", .data = &tphy_v1_pdata },
  	{ .compatible = "mediatek,generic-tphy-v2", .data = &tphy_v2_pdata },
  	{ .compatible = "mediatek,generic-tphy-v3", .data = &tphy_v3_pdata },
diff --git a/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch b/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch
index 67580f1e11..3b8285bf47 100644
--- a/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch
+++ b/target/linux/mediatek/patches-5.15/802-phy-phy-mtk-tphy-add-auto-load-valid-check-mechanism.patch
@@ -27,7 +27,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  	u32 efuse_intr_ln1;
  	u32 efuse_tx_imp_ln1;
  	u32 efuse_rx_imp_ln1;
-@@ -1125,6 +1129,7 @@ static int phy_efuse_get(struct mtk_tphy
+@@ -1126,6 +1130,7 @@ static int phy_efuse_get(struct mtk_tphy
  {
  	struct device *dev = &instance->phy->dev;
  	int ret = 0;
@@ -35,7 +35,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  
  	/* tphy v1 doesn't support sw efuse, skip it */
  	if (!tphy->pdata->sw_efuse_supported) {
-@@ -1139,6 +1144,20 @@ static int phy_efuse_get(struct mtk_tphy
+@@ -1140,6 +1145,20 @@ static int phy_efuse_get(struct mtk_tphy
  
  	switch (instance->type) {
  	case PHY_TYPE_USB2:
@@ -56,7 +56,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		ret = nvmem_cell_read_variable_le_u32(dev, "intr", &instance->efuse_intr);
  		if (ret) {
  			dev_err(dev, "fail to get u2 intr efuse, %d\n", ret);
-@@ -1157,6 +1176,20 @@ static int phy_efuse_get(struct mtk_tphy
+@@ -1158,6 +1177,20 @@ static int phy_efuse_get(struct mtk_tphy
  
  	case PHY_TYPE_USB3:
  	case PHY_TYPE_PCIE:
@@ -77,7 +77,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		ret = nvmem_cell_read_variable_le_u32(dev, "intr", &instance->efuse_intr);
  		if (ret) {
  			dev_err(dev, "fail to get u3 intr efuse, %d\n", ret);
-@@ -1190,6 +1223,20 @@ static int phy_efuse_get(struct mtk_tphy
+@@ -1191,6 +1224,20 @@ static int phy_efuse_get(struct mtk_tphy
  		if (tphy->pdata->version != MTK_PHY_V4)
  			break;
  
@@ -98,7 +98,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		ret = nvmem_cell_read_variable_le_u32(dev, "intr_ln1", &instance->efuse_intr_ln1);
  		if (ret) {
  			dev_err(dev, "fail to get u3 lane1 intr efuse, %d\n", ret);
-@@ -1241,6 +1288,10 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1242,6 +1289,10 @@ static void phy_efuse_set(struct mtk_phy
  
  	switch (instance->type) {
  	case PHY_TYPE_USB2:
@@ -109,7 +109,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		tmp = readl(u2_banks->misc + U3P_MISC_REG1);
  		tmp |= MR1_EFUSE_AUTO_LOAD_DIS;
  		writel(tmp, u2_banks->misc + U3P_MISC_REG1);
-@@ -1251,6 +1302,10 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1252,6 +1303,10 @@ static void phy_efuse_set(struct mtk_phy
  		writel(tmp, u2_banks->com + U3P_USBPHYACR1);
  		break;
  	case PHY_TYPE_USB3:
@@ -120,7 +120,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
  		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
  		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_RSV);
-@@ -1277,6 +1332,10 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1278,6 +1333,10 @@ static void phy_efuse_set(struct mtk_phy
  
  		break;
  	case PHY_TYPE_PCIE:
@@ -131,7 +131,7 @@ Signed-off-by: Zhanyong Wang <zhanyong.wang@mediatek.com>
  		tmp = readl(u3_banks->phyd + U3P_U3_PHYD_RSV);
  		tmp |= P3D_RG_EFUSE_AUTO_LOAD_DIS;
  		writel(tmp, u3_banks->phyd + U3P_U3_PHYD_RSV);
-@@ -1297,9 +1356,12 @@ static void phy_efuse_set(struct mtk_phy
+@@ -1298,9 +1357,12 @@ static void phy_efuse_set(struct mtk_phy
  		tmp &= ~P3A_RG_IEXT_INTR;
  		tmp |= P3A_RG_IEXT_INTR_VAL(instance->efuse_intr);
  		writel(tmp, u3_banks->phya + U3P_U3_PHYA_REG0);
diff --git a/target/linux/mpc85xx/patches-5.10/100-powerpc-85xx-tl-wdr4900-v1-support.patch b/target/linux/mpc85xx/patches-5.10/100-powerpc-85xx-tl-wdr4900-v1-support.patch
index 9bf9154e91..133364854a 100644
--- a/target/linux/mpc85xx/patches-5.10/100-powerpc-85xx-tl-wdr4900-v1-support.patch
+++ b/target/linux/mpc85xx/patches-5.10/100-powerpc-85xx-tl-wdr4900-v1-support.patch
@@ -19,7 +19,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -157,6 +157,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+@@ -158,6 +158,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
@@ -27,7 +27,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  
  src-wlib := $(sort $(src-wlib-y))
  src-plat := $(sort $(src-plat-y))
-@@ -336,7 +337,7 @@ image-$(CONFIG_TQM8555)			+= cuImage.tqm
+@@ -337,7 +338,7 @@ image-$(CONFIG_TQM8555)			+= cuImage.tqm
  image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
  image-$(CONFIG_SBC8548)			+= cuImage.sbc8548
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
diff --git a/target/linux/mpc85xx/patches-5.10/900-powerpc-bootwrapper-disable-uImage-generation.patch b/target/linux/mpc85xx/patches-5.10/900-powerpc-bootwrapper-disable-uImage-generation.patch
index 2ba3f83326..0f784a1051 100644
--- a/target/linux/mpc85xx/patches-5.10/900-powerpc-bootwrapper-disable-uImage-generation.patch
+++ b/target/linux/mpc85xx/patches-5.10/900-powerpc-bootwrapper-disable-uImage-generation.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -264,7 +264,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
+@@ -265,7 +265,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
  image-$(CONFIG_PPC_EFIKA)		+= zImage.chrp
  image-$(CONFIG_PPC_PMAC)		+= zImage.pmac
  image-$(CONFIG_PPC_HOLLY)		+= dtbImage.holly
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  image-$(CONFIG_EPAPR_BOOT)		+= zImage.epapr
  
  #
-@@ -395,15 +394,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
+@@ -396,15 +395,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
  $(obj)/vmlinux.strip: vmlinux
  	$(STRIP) -s -R .comment $< -o $@
  
diff --git a/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch b/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch
index e981ac85e4..e1e817c1f2 100644
--- a/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch
+++ b/target/linux/mpc85xx/patches-5.15/100-powerpc-85xx-tl-wdr4900-v1-support.patch
@@ -19,7 +19,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -162,6 +162,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+@@ -163,6 +163,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
@@ -27,7 +27,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
  
-@@ -342,7 +343,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+@@ -343,7 +344,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
  image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
  image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
diff --git a/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch b/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch
index c81ab7fcc2..ea5f5ab062 100644
--- a/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch
+++ b/target/linux/mpc85xx/patches-5.15/900-powerpc-bootwrapper-disable-uImage-generation.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -271,7 +271,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
+@@ -272,7 +272,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
  image-$(CONFIG_PPC_EFIKA)		+= zImage.chrp
  image-$(CONFIG_PPC_PMAC)		+= zImage.pmac
  image-$(CONFIG_PPC_HOLLY)		+= dtbImage.holly
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  image-$(CONFIG_EPAPR_BOOT)		+= zImage.epapr
  
  #
-@@ -403,15 +402,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
+@@ -404,15 +403,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
  $(obj)/vmlinux.strip: vmlinux
  	$(STRIP) -s -R .comment $< -o $@
  
diff --git a/target/linux/mvebu/cortexa72/config-5.15 b/target/linux/mvebu/cortexa72/config-5.15
index 37379834d3..cb27e0285f 100644
--- a/target/linux/mvebu/cortexa72/config-5.15
+++ b/target/linux/mvebu/cortexa72/config-5.15
@@ -12,6 +12,7 @@ CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
+CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
diff --git a/target/linux/mxs/profiles/02-olinuxino-maxi.mk b/target/linux/mxs/profiles/02-olinuxino-maxi.mk
index 662c9f2254..dd333629b8 100644
--- a/target/linux/mxs/profiles/02-olinuxino-maxi.mk
+++ b/target/linux/mxs/profiles/02-olinuxino-maxi.mk
@@ -5,8 +5,8 @@
 define Profile/olinuxino-maxi
   NAME:=Olimex OLinuXino Maxi/Mini boards
   PACKAGES += imx-bootlets uboot-mxs-mx23_olinuxino \
-	  kmod-usb-net-smsc95xx kmod-gpio-mcp23s08 \
-	  kmod-leds-gpio kmod-sound-core
+	  kmod-usb-net-smsc95xx kmod-pinctrl-mcp23s08-i2c \
+	  kmod-pinctrl-mcp23s08-spi kmod-leds-gpio kmod-sound-core
 endef
 
 define Profile/olinuxino-maxi/Description
diff --git a/target/linux/mxs/profiles/03-olinuxino-micro.mk b/target/linux/mxs/profiles/03-olinuxino-micro.mk
index 31a767188c..8413ebbdca 100644
--- a/target/linux/mxs/profiles/03-olinuxino-micro.mk
+++ b/target/linux/mxs/profiles/03-olinuxino-micro.mk
@@ -5,7 +5,8 @@
 define Profile/olinuxino-micro
   NAME:=Olimex OLinuXino Micro/Nano boards
   PACKAGES += imx-bootlets uboot-mxs-mx23_olinuxino \
-	  kmod-gpio-mcp23s08 kmod-leds-gpio
+	  kmod-pinctrl-mcp23s08-spi kmod-pinctrl-mcp23s08-i2c \
+	  kmod-leds-gpio
 endef
 
 define Profile/olinuxino-micro/Description
diff --git a/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch b/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
index 6c795c1d25..f609f1b12a 100644
--- a/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
+++ b/target/linux/oxnas/patches-5.15/100-oxnas-clk-plla-pllb.patch
@@ -179,7 +179,7 @@
  static inline struct clk_oxnas_gate *to_clk_oxnas_gate(struct clk_hw *hw)
  {
  	return container_of(hw, struct clk_oxnas_gate, hw);
-@@ -249,3 +401,42 @@ static struct platform_driver oxnas_stdc
+@@ -251,3 +403,42 @@ static struct platform_driver oxnas_stdc
  	},
  };
  builtin_platform_driver(oxnas_stdclk_driver);
diff --git a/target/linux/ramips/dts/mt7621_yuncore_fap640.dts b/target/linux/ramips/dts/mt7621_yuncore_fap640.dts
new file mode 100644
index 0000000000..a0c32a0211
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_yuncore_fap640.dts
@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	compatible = "yuncore,fap640", "mediatek,mt7621-soc";
+	model = "YunCore FAP640";
+
+	aliases {
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: status_red {
+			label = "red:status";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_blue: status_blue {
+			label = "blue:status";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "green:wan";
+			gpios = <&switch0 12 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:04:link";
+		};
+
+		lan1 {
+			label = "green:lan1";
+			gpios = <&switch0 9 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "mt7530-0:03:link";
+		};
+
+		lan2 {
+			label = "green:lan2";
+			gpios = <&switch0 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:02:link";
+		};
+
+		lan3 {
+			label = "green:lan3";
+			gpios = <&switch0 3 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:01:link";
+		};
+
+		lan4 {
+			label = "green:lan4";
+			gpios = <&switch0 0 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mt7530-0:00:link";
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		hw_margin_ms = <200>;
+		always-running;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <80000000>;
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			/* range 0x40000 to 0x50000 is empty in vendor
+			 * firmware, so we do not use it either
+			 */
+
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x40000>;
+				read-only;
+			};
+
+			partition@90000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x90000 0xf70000>;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_0004>;
+	nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+	gpio-controller;
+	#gpio-cells = <2>;
+
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "wan";
+			nvmem-cells = <&macaddr_factory_0004>;
+			nvmem-cell-names = "mac-address";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_0004: macaddr@0004 {
+		reg = <0x0004 0x6>;
+	};
+};
+
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index c942d76ddc..5b37ad3ae0 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -2264,6 +2264,16 @@ define Device/yuncore_ax820
 endef
 TARGET_DEVICES += yuncore_ax820
 
+define Device/yuncore_fap640
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 15808k
+  DEVICE_VENDOR := YunCore
+  DEVICE_MODEL := FAP640
+  DEVICE_PACKAGES := kmod-mt7915e
+endef
+TARGET_DEVICES += yuncore_fap640
+
 define Device/zbtlink_zbt-we1326
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 3c2872ae2c..ca69745ba6 100644
--- a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -126,6 +126,11 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && \
 			macaddr_setbit_la "$(mtd_get_mac_binary Factory 0xe000)" > /sys${DEVPATH}/macaddress
 		;;
+	yuncore,fap640)
+		hw_mac_addr="$(mtd_get_mac_binary Factory 0x4)"
+		[ "$PHYNBR" = "0" ] && macaddr_setbit_la "$hw_mac_addr" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && echo -n "$hw_mac_addr" > /sys${DEVPATH}/macaddress
+		;;
 	zyxel,nwa50ax|\
 	zyxel,nwa55axe)
 		hw_mac_addr="$(mtd_get_mac_binary mrd 0x1fff8)"
diff --git a/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/dsa.c b/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/dsa.c
index 10e6103f0d..6ef255db4b 100644
--- a/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/dsa.c
+++ b/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/dsa.c
@@ -162,6 +162,16 @@ static void rtl83xx_setup_bpdu_traps(struct rtl838x_switch_priv *priv)
 		priv->r->set_receive_management_action(i, BPDU, COPY2CPU);
 }
 
+static void rtl83xx_port_set_salrn(struct rtl838x_switch_priv *priv,
+				   int port, bool enable)
+{
+	int shift = SALRN_PORT_SHIFT(port);
+	int val = enable ? SALRN_MODE_HARDWARE : SALRN_MODE_DISABLED;
+
+	sw_w32_mask(SALRN_MODE_MASK << shift, val << shift,
+		    priv->r->l2_port_new_salrn(port));
+}
+
 static int rtl83xx_setup(struct dsa_switch *ds)
 {
 	int i;
@@ -205,6 +215,9 @@ static int rtl83xx_setup(struct dsa_switch *ds)
 
 	priv->r->l2_learning_setup();
 
+	rtl83xx_port_set_salrn(priv, priv->cpu_port, false);
+	ds->assisted_learning_on_cpu_port = true;
+
 	/*
 	 *  Make sure all frames sent to the switch's MAC are trapped to the CPU-port
 	 *  0: FWD, 1: DROP, 2: TRAP2CPU
@@ -263,6 +276,9 @@ static int rtl93xx_setup(struct dsa_switch *ds)
 
 	priv->r->l2_learning_setup();
 
+	rtl83xx_port_set_salrn(priv, priv->cpu_port, false);
+	ds->assisted_learning_on_cpu_port = true;
+
 	rtl83xx_enable_phy_polling(priv);
 
 	priv->r->pie_init(priv);
@@ -1537,23 +1553,32 @@ static int rtl83xx_vlan_del(struct dsa_switch *ds, int port,
 
 static void rtl83xx_setup_l2_uc_entry(struct rtl838x_l2_entry *e, int port, int vid, u64 mac)
 {
-	e->is_ip_mc = e->is_ipv6_mc  = false;
+	memset(e, 0, sizeof(*e));
+
+	e->type = L2_UNICAST;
 	e->valid = true;
+
 	e->age = 3;
-	e->port = port,
-	e->vid = vid;
+	e->is_static = true;
+
+	e->port = port;
+
+	e->rvid = e->vid = vid;
+	e->is_ip_mc = e->is_ipv6_mc = false;
 	u64_to_ether_addr(mac, e->mac);
 }
 
-static void rtl83xx_setup_l2_mc_entry(struct rtl838x_switch_priv *priv,
-				      struct rtl838x_l2_entry *e, int vid, u64 mac, int mc_group)
+static void rtl83xx_setup_l2_mc_entry(struct rtl838x_l2_entry *e, int vid, u64 mac, int mc_group)
 {
-	e->is_ip_mc = e->is_ipv6_mc  = false;
-	e->valid = true;
-	e->mc_portmask_index = mc_group;
+	memset(e, 0, sizeof(*e));
+
 	e->type = L2_MULTICAST;
+	e->valid = true;
+
+	e->mc_portmask_index = mc_group;
+
 	e->rvid = e->vid = vid;
-	pr_debug("%s: vid: %d, rvid: %d\n", __func__, e->vid, e->rvid);
+	e->is_ip_mc = e->is_ipv6_mc = false;
 	u64_to_ether_addr(mac, e->mac);
 }
 
@@ -1768,7 +1793,7 @@ static void rtl83xx_port_mdb_add(struct dsa_switch *ds, int port,
 				err = -ENOTSUPP;
 				goto out;
 			}
-			rtl83xx_setup_l2_mc_entry(priv, &e, vid, mac, mc_group);
+			rtl83xx_setup_l2_mc_entry(&e, vid, mac, mc_group);
 			priv->r->write_l2_entry_using_hash(idx >> 2, idx & 0x3, &e);
 		}
 		goto out;
@@ -1789,7 +1814,7 @@ static void rtl83xx_port_mdb_add(struct dsa_switch *ds, int port,
 				err = -ENOTSUPP;
 				goto out;
 			}
-			rtl83xx_setup_l2_mc_entry(priv, &e, vid, mac, mc_group);
+			rtl83xx_setup_l2_mc_entry(&e, vid, mac, mc_group);
 			priv->r->write_cam(idx, &e);
 		}
 		goto out;
diff --git a/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/rtl838x.h b/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/rtl838x.h
index e2b82a4975..10913dacef 100644
--- a/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/rtl838x.h
+++ b/target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/rtl838x.h
@@ -245,6 +245,12 @@
 #define RTL839X_L2_PORT_NEW_SALRN(p)		(0x38F0 + (((p >> 4) << 2)))
 #define RTL930X_L2_PORT_SALRN(p)		(0x8FEC + (((p >> 4) << 2)))
 #define RTL931X_L2_PORT_NEW_SALRN(p)		(0xC820 + (((p >> 4) << 2)))
+
+#define SALRN_PORT_SHIFT(p)			((p % 16) * 2)
+#define SALRN_MODE_MASK				0x3
+#define SALRN_MODE_HARDWARE			0
+#define SALRN_MODE_DISABLED			2
+
 #define RTL838X_L2_PORT_NEW_SA_FWD(p)		(0x3294 + (((p >> 4) << 2)))
 #define RTL839X_L2_PORT_NEW_SA_FWD(p)		(0x3900 + (((p >> 4) << 2)))
 #define RTL930X_L2_PORT_NEW_SA_FWD(p)		(0x8FF4 + (((p / 10) << 2)))
diff --git a/target/linux/realtek/files-5.10/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-5.10/drivers/net/ethernet/rtl838x_eth.c
index f5424bbfa3..be84549b9e 100644
--- a/target/linux/realtek/files-5.10/drivers/net/ethernet/rtl838x_eth.c
+++ b/target/linux/realtek/files-5.10/drivers/net/ethernet/rtl838x_eth.c
@@ -2247,7 +2247,7 @@ static int rtl83xx_set_features(struct net_device *dev, netdev_features_t featur
 		if (!(features & NETIF_F_RXCSUM))
 			sw_w32_mask(BIT(3), 0, priv->r->mac_port_ctrl(priv->cpu_port));
 		else
-			sw_w32_mask(0, BIT(4), priv->r->mac_port_ctrl(priv->cpu_port));
+			sw_w32_mask(0, BIT(3), priv->r->mac_port_ctrl(priv->cpu_port));
 	}
 
 	return 0;
diff --git a/target/linux/realtek/patches-5.10/300-mips-add-rtl838x-platform.patch b/target/linux/realtek/patches-5.10/300-mips-add-rtl838x-platform.patch
index eaf03c74f9..3834ba7c61 100644
--- a/target/linux/realtek/patches-5.10/300-mips-add-rtl838x-platform.patch
+++ b/target/linux/realtek/patches-5.10/300-mips-add-rtl838x-platform.patch
@@ -84,7 +84,7 @@ Submitted-by: Birger Koblitz <git@birger-koblitz.de>
  source "arch/mips/alchemy/Kconfig"
  source "arch/mips/ath25/Kconfig"
  source "arch/mips/ath79/Kconfig"
-@@ -1097,6 +1151,9 @@ config CEVT_GT641XX
+@@ -1097,6 +1147,9 @@ config CEVT_GT641XX
  config CEVT_R4K
  	bool
  
diff --git a/target/linux/rockchip/armv8/config-5.15 b/target/linux/rockchip/armv8/config-5.15
index 275fa201a8..d259e8de6b 100644
--- a/target/linux/rockchip/armv8/config-5.15
+++ b/target/linux/rockchip/armv8/config-5.15
@@ -29,6 +29,7 @@ CONFIG_ARM64_ERRATUM_832075=y
 CONFIG_ARM64_ERRATUM_843419=y
 CONFIG_ARM64_ERRATUM_845719=y
 CONFIG_ARM64_ERRATUM_858921=y
+CONFIG_ARM64_ERRATUM_1742098=y
 CONFIG_ARM64_HW_AFDBM=y
 CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
 CONFIG_ARM64_MODULE_PLTS=y